Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1501298
MD5:	04be8820c8ffcee33536d8299e5ce0a4
SHA1:	1cbe167f16fc6c296b2738ebcc5b3392a32cdfca
SHA256:	e9d2ca10e32326c624c6c9b0c5eaf1742e8566439ffc817a893ec5a53b55798b
Tags:	exe
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7552 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 04BE8820C8FFCEE33536D8299E5CE0A4)

msedge.exe (PID: 7568 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7824 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2096,i,6555085097696999869,11138024300958431153,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7832 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8104 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6256 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8960 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6500 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9036 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7224 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7224 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 1612 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8804 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3496 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9152 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4256 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9616 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 10100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1904,i,904783541810693917,8997423622373591723,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8260 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5480 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2060,i,1564144470648911269,596232367200528838,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9912 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3336 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2052,i,125651995500428763,9374026523037339469,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2895988617.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.11.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.11.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.11.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 16214a8e-c45e-4a95-a08d-8a90b69c44b0.tmp.12.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.11.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 16214a8e-c45e-4a95-a08d-8a90b69c44b0.tmp.12.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.11.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: content_new.js.11.dr, content.js.11.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 16214a8e-c45e-4a95-a08d-8a90b69c44b0.tmp.12.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49801 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0013EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0013EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0013ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0013ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0013EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0012AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0012AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00159576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00159576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1644446526.0000000000182000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2cdd52a1-8
Source: file.exe, 00000000.00000000.1644446526.0000000000182000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_89c9c456-4
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_39c20508-f
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c05272a4-3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0012D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0012D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00121201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00121201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0012E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0012E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00132046	0_2_00132046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000C8060	0_2_000C8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00128298	0_2_00128298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000FE4FF	0_2_000FE4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F676B	0_2_000F676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00154873	0_2_00154873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000ECAA0	0_2_000ECAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000CCAF0	0_2_000CCAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000DCC39	0_2_000DCC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F6DD9	0_2_000F6DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000DB119	0_2_000DB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000C91C0	0_2_000C91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E1394	0_2_000E1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E1706	0_2_000E1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E781B	0_2_000E781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000C7920	0_2_000C7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000D997D	0_2_000D997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E19B0	0_2_000E19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E7A4A	0_2_000E7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E1C77	0_2_000E1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E7CA7	0_2_000E7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0014BE44	0_2_0014BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F9EEE	0_2_000F9EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E1F32	0_2_000E1F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 000DF9F2 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 000E0A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.evad.winEXE@96/518@20/15

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001337B5 GetLastError,FormatMessageW,

0_2_001337B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001210BF AdjustTokenPrivileges,CloseHandle,		0_2_001210BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001216C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_001216C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001351CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_001351CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0014A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0014A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0013648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0013648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_000C42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\ca54caa8-83f2-4bcd-ac2d-8cc602abfb13.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.11.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2096,i,6555085097696999869,11138024300958431153,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6256 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6500 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7224 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7224 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3496 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4256 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1904,i,904783541810693917,8997423622373591723,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2060,i,1564144470648911269,596232367200528838,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2052,i,125651995500428763,9374026523037339469,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2096,i,6555085097696999869,11138024300958431153,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2060,i,1564144470648911269,596232367200528838,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6256 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6500 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7224 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7224 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3496 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4256 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1904,i,904783541810693917,8997423622373591723,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2060,i,1564144470648911269,596232367200528838,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2052,i,125651995500428763,9374026523037339469,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000C42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E0A76 push ecx; ret

0_2_000E0A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000DF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_000DF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00151C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00151C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-97164

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6486

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\file.exe TID: 7556

Thread sleep time: -64860s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6486 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0012DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001368EE FindFirstFileW,FindClose,	0_2_001368EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0013698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0012D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0012D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00139642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00139642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0013979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00139B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00139B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00135C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00135C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000C42DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-97077

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0013EAA2 BlockInput,

0_2_0013EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000F2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000C42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E4CE8 mov eax, dword ptr fs:[00000030h]

0_2_000E4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00120B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00120B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000F2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000E083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E09D5 SetUnhandledExceptionFilter,	0_2_000E09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000E0C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00121201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00102BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00102BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0012B226 SendInput,keybd_event,

0_2_0012B226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001422DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_001422DA

Source: C:\Users\user\Desktop\file.exe

0_2_00120B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00121663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00121663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E0698 cpuid

0_2_000E0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00138195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00138195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0011D27A GetUserNameW,

0_2_0011D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000FBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_000FBB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000C42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00141204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00141204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00141806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00141806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://clients2.googleusercontent.com/crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true	false	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
s-part-0036.t-0009.t-msedge.net	13.107.246.64	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.16.129	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	URL Reputation: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.11.dr	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://msn.com	data_10.5.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.11.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.11.dr	false	Avira URL Cloud: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.11.dr, content.js.11.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.11.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	16214a8e-c45e-4a95-a08d-8a90b69c44b0.tmp.12.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.11.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.64	s-part-0036.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
142.250.80.67	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.35.174	unknown	United States	15169	GOOGLEUS	false
142.250.65.174	unknown	United States	15169	GOOGLEUS	false
172.217.16.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.251.40.164	unknown	United States	15169	GOOGLEUS	false
23.223.209.213	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.31.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501298
Start date and time:	2024-08-29 17:23:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@96/518@20/15
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 42 Number of non-executed functions: 310
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 66.102.1.84, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.145, 2.19.126.152, 172.217.16.131, 142.250.186.35, 2.23.209.175, 2.23.209.171, 2.23.209.173, 2.23.209.176, 2.23.209.174, 2.23.209.168, 2.23.209.162, 2.23.209.166, 2.23.209.167, 142.250.186.142, 2.19.126.163, 192.229.221.95, 142.250.185.138, 142.250.186.170, 142.250.186.106, 172.217.16.138, 142.250.186.138, 142.250.181.234, 142.250.186.74, 142.250.185.106, 142.250.185.170, 142.250.185.74, 142.250.186.42, 142.250.185.234, 216.58.212.170, 142.250.74.202, 142.250.184.234, 142.250.185.202, 142.251.41.3, 142.251.40.195, 142.250.80.99, 142.250.81.227, 142.250.65.163, 142.250.80.35, 142.251.40.99
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-0007.config.skype.com, edgeassetservice.azureedge.net, azureedge-t-prod.trafficmanager.net, busi
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:24:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
16:24:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
16:24:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
16:24:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.64	file.exe	Get hash	malicious	Unknown	Browse
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://pub-ca67445aaabc47d0bd9966953d9e2b17.r2.dev/traffic.html?user-agent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=Tara.LaClair%40Steptoe-Johnson.com&senderemailaddress=sszwarc%40MercBank.com&senderorganization=AwGAAAAAAnwAAAADAQAAAAB4L2sP04tHoRgQy9kdN5NPVT1tZXJjYmFuazAub25taWNyb3NvZnQuY29tLE9VPU1pY3Jvc29mdCBFeGNoYW5nZSBIb3N0ZWQgT3JnYW5pemF0aW9ucyxEQz1OQU1QUjE1QTAwMixEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NiRJZGS9IYEeji1osys3BpUNOPUNvbmZpZ3VyYXRpb24sQ049bWVyY2JhbmswLm9ubWljcm9zb2Z0LmNvbSxDTj1Db25maWd1cmF0aW9uVW5pdHMsREM9TkFNUFIxNUEwMDIsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTQE%3d&messageid=%3cSA1PR15MB5013A9396562F78FDD94A844D7812%40SA1PR15MB5013.namprd15.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40mercbank0.onmicrosoft.com&consumerEncryption=false&senderorgid=eda5640b-de2a-4a70-8a6e-b9b732c16c38&urldecoded=1&e4e_sdata=EpAebyUyhbp5qjBRCejClul%2bO0wRydv1eJUK4qhZNRr0%2bzDWWfXCtf65jmdkNdBUWfXHNGyyHkWBVsCBCGfBpV5cdtKksOzfyu%2fmYa0Ftd3xTjHmXXenRXgUA0PR3gh5sR2ve%2bXE8dZCafVion%2bI0xm7xM0WcwXEUpGBGC8um4aIRyLVcAtc7h%2bCF%2fGZB16AaYsprv6yVHs7DZ5VNxYzLxaXnrSeE5gRbw0Z1wjaZ%2fLsBubfjF6gF%2fTa7wyY1NzrCFy0ptnoii1J%2f8CwlNK1zNO7c1e1wINfHPNA0%2f3Sy7hhDnvOn0PqTNFKAsZ49Up0Css4iDSm2eE2BPpARvHUGQ%3d%3d	Get hash	malicious	Unknown	Browse
	https://us.pbe.encryption.symantec.com/login.html?msgUserId=7b0b56a87350ebd5&enterprise=sigmafinancial&rrRegcode=69GdzP9T&locale=en_US	Get hash	malicious	Unknown	Browse
	https://url.uk.m.mimecastprotect.com/s/P4YvCp88zsEr4xMcPfwuGVGsq?domain=file365-cloud.s3.eu-west-2.amazonaws.com	Get hash	malicious	HTMLPhisher	Browse
	022 0.10.htm	Get hash	malicious	HTMLPhisher	Browse
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0014.t-0009.t-msedge.net	http://control.frilix.com/grace/fxc/aW5mby5jcmVkaXRldXJlbkBicmVkYS5ubA==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	https://sesh-gangrene.shop/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	Order items.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.42
	http://v3r1fy.tdr1v.freemyip.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	EFT-NOTE-test-08292024.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	https://cb1cd44761364cecb21c459c42a86757.svc.dynamics.com/t/t/oIX7RshqCPFFtVxUphHklxDHFg31zySxgRv75vmlL2Yx/ipf8JYDu9fTBRLVxBJ5f98zUiqcPZCqXAj98vZXuDQkx	Get hash	malicious	Unknown	Browse	13.107.246.42
s-part-0036.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://pub-ca67445aaabc47d0bd9966953d9e2b17.r2.dev/traffic.html?user-agent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=Tara.LaClair%40Steptoe-Johnson.com&senderemailaddress=sszwarc%40MercBank.com&senderorganization=AwGAAAAAAnwAAAADAQAAAAB4L2sP04tHoRgQy9kdN5NPVT1tZXJjYmFuazAub25taWNyb3NvZnQuY29tLE9VPU1pY3Jvc29mdCBFeGNoYW5nZSBIb3N0ZWQgT3JnYW5pemF0aW9ucyxEQz1OQU1QUjE1QTAwMixEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NiRJZGS9IYEeji1osys3BpUNOPUNvbmZpZ3VyYXRpb24sQ049bWVyY2JhbmswLm9ubWljcm9zb2Z0LmNvbSxDTj1Db25maWd1cmF0aW9uVW5pdHMsREM9TkFNUFIxNUEwMDIsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTQE%3d&messageid=%3cSA1PR15MB5013A9396562F78FDD94A844D7812%40SA1PR15MB5013.namprd15.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40mercbank0.onmicrosoft.com&consumerEncryption=false&senderorgid=eda5640b-de2a-4a70-8a6e-b9b732c16c38&urldecoded=1&e4e_sdata=EpAebyUyhbp5qjBRCejClul%2bO0wRydv1eJUK4qhZNRr0%2bzDWWfXCtf65jmdkNdBUWfXHNGyyHkWBVsCBCGfBpV5cdtKksOzfyu%2fmYa0Ftd3xTjHmXXenRXgUA0PR3gh5sR2ve%2bXE8dZCafVion%2bI0xm7xM0WcwXEUpGBGC8um4aIRyLVcAtc7h%2bCF%2fGZB16AaYsprv6yVHs7DZ5VNxYzLxaXnrSeE5gRbw0Z1wjaZ%2fLsBubfjF6gF%2fTa7wyY1NzrCFy0ptnoii1J%2f8CwlNK1zNO7c1e1wINfHPNA0%2f3Sy7hhDnvOn0PqTNFKAsZ49Up0Css4iDSm2eE2BPpARvHUGQ%3d%3d	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://us.pbe.encryption.symantec.com/login.html?msgUserId=7b0b56a87350ebd5&enterprise=sigmafinancial&rrRegcode=69GdzP9T&locale=en_US	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://url.uk.m.mimecastprotect.com/s/P4YvCp88zsEr4xMcPfwuGVGsq?domain=file365-cloud.s3.eu-west-2.amazonaws.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	022 0.10.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://iv1tm.ykrbkt.ru/iV1TM/#hans.wurst@us.com	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://www.water-filter.com	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.253.42
	SecuriteInfo.com.Linux.Siggen.9999.6015.2041.elf	Get hash	malicious	Mirai	Browse	20.41.197.130
	SecuriteInfo.com.Linux.Siggen.9999.16227.30183.elf	Get hash	malicious	Mirai	Browse	20.46.111.111
	Message-ID 08282024 110831 PM.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.253.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	http://control.frilix.com/grace/fxc/aW5mby5jcmVkaXRldXJlbkBicmVkYS5ubA==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://sesh-gangrene.shop/	Get hash	malicious	HTMLPhisher	Browse	20.190.159.0
	https://set.page/cdtautomotive/	Get hash	malicious	Unknown	Browse	13.107.246.60
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://www.water-filter.com	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.253.42
	SecuriteInfo.com.Linux.Siggen.9999.6015.2041.elf	Get hash	malicious	Mirai	Browse	20.41.197.130
	SecuriteInfo.com.Linux.Siggen.9999.16227.30183.elf	Get hash	malicious	Mirai	Browse	20.46.111.111
	Message-ID 08282024 110831 PM.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.253.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	http://control.frilix.com/grace/fxc/aW5mby5jcmVkaXRldXJlbkBicmVkYS5ubA==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://sesh-gangrene.shop/	Get hash	malicious	HTMLPhisher	Browse	20.190.159.0
	https://set.page/cdtautomotive/	Get hash	malicious	Unknown	Browse	13.107.246.60
EDGECASTUS	https://alkimialofts.com/on%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	HTMLPhisher	Browse	192.229.133.221
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://control.frilix.com/grace/fxc/aW5mby5jcmVkaXRldXJlbkBicmVkYS5ubA==	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://sesh-gangrene.shop/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://bio.to/vCOt6d	Get hash	malicious	HTMLPhisher	Browse	93.184.221.165
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://tinyurl.com/NDCEurope	Get hash	malicious	Unknown	Browse	93.184.221.165
	SecuriteInfo.com.Program.RemoteAdminNET.1.15125.10364.msi	Get hash	malicious	AteraAgent	Browse	152.199.23.209
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://alkimialofts.com/on%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	http://idtyvfyfmst.weebly.com	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	https://decktop.us/MUYKd1	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	sxs.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	http://www.water-filter.com	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	http://econltractors.com	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	http://general72.s3-website.us-east-2.amazonaws.com	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	http://premium.davidabostic.com	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	https://elc-path.com/pdfglobal2/docs89q9eqwwe/login.php#wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71144
Entropy (8bit):	6.072775977088945
Encrypted:	false
SSDEEP:	1536:rMGQ5XMBGJdJxQjVor3WaO/mJTpm0bSis90eWLvm54luGe:rMrJM8vJcWWaMaC70eWLe509e
MD5:	189B94A270535DA0F71495BE1116F257
SHA1:	9D6BCE9328C82EDB62C21C37EE52AC09E608B00B
SHA-256:	22E868AA8E8697314182DDDE7C1F8609CA9A6F5D308BFC827D8FD51232D9959B
SHA-512:	ED1130C0534BDF94AC3812355A1D76965E13EB51F2EDD8491079FF1F2A5E3252CA86157124A27526072A4BC5AA3C746F781C9254173DC811C14CDD33949A8C58
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369418637136918","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\10f6474e-6c76-49c8-a80b-93c32fd8aaf7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3334
Entropy (8bit):	5.613974656604212
Encrypted:	false
SSDEEP:	96:0q8NkC1fwCk4RV6HhB87vREWy1JkTcEVSDS4S4SDSoI4a:/8NbyCkYVKHt7kTG
MD5:	4AA981094CD66FFA281DA77D4A4B05CA
SHA1:	F554FFDC1B2F68344913BE2F3EA8563019186E4B
SHA-256:	56A80CC99E433CD50BC964F052E601405412F6932D1DF5073BBDC4A81A50374E
SHA-512:	AB6D93E44C1615738F57080DF09CD9C071439D6E3B8D0BDDFED15BCDB301942D26ADC4A4F568A56A88062959FB308EDB09852B14731E637BD9B641EDE9D21C16
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1ae0279d-b721-47b6-8723-d9e2ad66edf1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.592642220721438
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afwCk0fRV6skHB+DdrxdvBfEkXRWjQaJkXjcE9wlRbM2B0:Xq8NkC1fwCk4RV6HB87vRzWjJJkTcEKW
MD5:	9034F06066C162425B4E3B8323EC2405
SHA1:	CCC0B517F8A4460868897B1F9CCE7C5A91563353
SHA-256:	6D5BDC3E50C91241A1558B192AA55FD03B30D7012025198B454C8CDFA3799D8D
SHA-512:	1A2004E26E01DDC1FDF5853989765EDC17A9C4047CEDB8437E0F966868F14E06817C4F240DE406B89B0DC9F5C8CBF5E8D40B135AA4A56796B19BFBC12C4CB7A9
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"policy":{"last_statistics_update":"13369418635129286"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\44f56bce-714a-4924-8aba-c0e3734f03e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20994
Entropy (8bit):	6.064791498584407
Encrypted:	false
SSDEEP:	384:xtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSE46kYV4RZ4TV+Mh0lkdHd5qV:rMGQ7FCYXGIgtDAWtJ4nI46kYSZ4Tphq
MD5:	87C0E68566DF304E621033D6D49A3335
SHA1:	B4A6D2CD1EA51DAF83B816F1BEA476A8FD3347D8
SHA-256:	C5ECE0375CCB7273D7E4BDFBD50C268259031442B8328502F748A7A80AEE5084
SHA-512:	6428BEA16246CEF0EC6A102B391701955DB7F5EC0A68A8E6A3EB302D3112127E75412A3D175C3CEA4FDADAEB125C45F31C56B5D5DEB900F35331F0E9A56E10D8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369418637136918","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\50b2cc96-55f9-450e-8299-f3721dfd883a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5a5e6458-0ed4-4071-b3af-b07f528adfb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.592642220721438
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afwCk0fRV6skHB+DdrxdvBfEkXRWjQaJkXjcE9wlRbM2B0:Xq8NkC1fwCk4RV6HB87vRzWjJJkTcEKW
MD5:	9034F06066C162425B4E3B8323EC2405
SHA1:	CCC0B517F8A4460868897B1F9CCE7C5A91563353
SHA-256:	6D5BDC3E50C91241A1558B192AA55FD03B30D7012025198B454C8CDFA3799D8D
SHA-512:	1A2004E26E01DDC1FDF5853989765EDC17A9C4047CEDB8437E0F966868F14E06817C4F240DE406B89B0DC9F5C8CBF5E8D40B135AA4A56796B19BFBC12C4CB7A9
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"policy":{"last_statistics_update":"13369418635129286"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\913cea49-d0e6-4402-82ac-3d834184428b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20994
Entropy (8bit):	6.064804437820092
Encrypted:	false
SSDEEP:	384:xtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSE46kYV5RZ4TV+Mh0lkdHd5qV:rMGQ7FCYXGIgtDAWtJ4nI46kYtZ4Tphq
MD5:	2FD656A5B0A0589759AEDF2BCB374DA1
SHA1:	7A46CCD384C77C26C59B17AD79D7E7834C2094B9
SHA-256:	6FEC562CF37C6E9D8FABA5F8A6AA850EF0EB87D7174A04EEDE92185C6CBB2061
SHA-512:	3F55D6E23C759F9A9D5F5F3C598106FFDFFB2EA660F6E6FA5F283D461003630B0DCCDDF56A55A1CDBA2BE4F632FDE4EFE07F36A1711905FAFA07E498609D0F12
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369418637136918","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\98102570-9e1b-428d-8893-2323072412e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24330
Entropy (8bit):	6.057011327184922
Encrypted:	false
SSDEEP:	384:xtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NGE46kYV4RFzqdpVE4luV+Mh0lkdHd5qV:rMGQ7FCYXGIgtDAWtJ4nW46kYSFZ4lu6
MD5:	3CCFE918A7A3B3C20A90D81937C9E650
SHA1:	938A46146407398A368AA0BE2D8DCEB2DBCC9A0F
SHA-256:	89F59B834BCE2ECF037CC685C06D2088C1F4FCC12907F3A2AD0BB2E5B7944519
SHA-512:	131F22EEE3E6F4456E397EFDABAFB880C916CA37E0CD992D23A4730119B51116C865C68B64E66719B29955B3BA1ECCA12DE22FE14227B581121744A3AE4A6DB4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369418637136918","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\ce80363b-ee5c-434f-aa7b-1f6b4fa48246.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D0928A-1D90.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04049544693764079
Encrypted:	false
SSDEEP:	192:f4UjLYiVWK+ggCdl7JtD+FX9XaokgV8vYhXxNEq4bcRQMYpF1n8y08Tcm2RGOdB:AUjjlXqvnhBCQAF108T2RGOD
MD5:	EE5B2C38A46A354CAF16B941F267CC2E
SHA1:	B9A5C70E7E5BE003226C04944DDFC61CA2123033
SHA-256:	A107C53C18EA62A5D501E8BCF339452B164EA7D486D7D0FEED10F3DF39C1BF56
SHA-512:	2259DAC9CED941C36FB251D23BBA8D6BF908ABFFF5F580E65A24E64618B2D63D5B9F318A4E9E01A1F265663582F66BA4CDB99485B7BA2835C3E59CA688361A12
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".prmlrq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............=.....................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...b.X9..A@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D0928B-1E98.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45725603832842954
Encrypted:	false
SSDEEP:	3072:wBAVNklcQH4yM9Wf2IGKGMnFyDYjPfZh5N+Bnhug1HFuHii34/uA+/eqbRfVqfjc:anlvnMVnhuaHJmwt0OM4aHCPQFPA
MD5:	CEC7E25ECD40E690983EB30EBCB4E2C1
SHA1:	2E9DDF041225D481456897A8D26CA1322817027A
SHA-256:	5116C2A27D8281787BCC07C41189E381FC50A05E66F3E641A56A7F140C918F62
SHA-512:	7A925BA50C1ACA3054122707C657A19D24DC3C3D0FEC6DEA24EBE3F29B692BE3B6998FA08612F9018FE5120561AABAB1010824229CCE1FDB460513DD398FD844
Malicious:	false
Preview:	...@..@...@.....C.].....@................A...A..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".prmlrq20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.125729023790717
Encrypted:	false
SSDEEP:	3:FiWWltlZpLK9fHSRqOFhJXI2EyBl+BVP/Sh/JzvZZWGHIE92gRGHudWXl:o1LK9yRqsx+BVsJDDWdXgXE
MD5:	FEFA54D63C36CCC09ED2F365A735091E
SHA1:	61C32F464AB2561945A34703C3DE5E57011E2847
SHA-256:	1E0D9806326F5EC411271C7583A1EF98776A81AF90080B388708FA5E19E4DF17
SHA-512:	6CD5580435643A3CFDC2D7B401B58020B1D2AC45E95081C011814A8D52AA9619F5B3F5489B84FE1204120BBDAA950565A2A64AD148FB5174E37E13EA053E734E
Malicious:	false
Preview:	sdPC....................6S....iD..n;p2@."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ac67c3cb-ab8b-434e-8469-ab9e09b85c3a............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1fae9231-cd83-4bfc-b986-f600a05ee80e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565614201248013
Encrypted:	false
SSDEEP:	768:uAqB7oWPKwfRU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnCPFDrwrVpGtuv:uAqB7oWPKwfRUu1jamyF4Wto
MD5:	B9240EC246B87A402C32CC0D01FA50C6
SHA1:	ED41A825DB383DDF792B4E3893A99CD09D797625
SHA-256:	B2507BDD5DD58687BC4123FBF6CC9A03D9CC69264726CD21A2124096A5ECEC9B
SHA-512:	1D0FE602B785FF200B13A00E41888CB8673D58F1DD1F4FD001250157DD38B8FF06241220912087CEB60951CC72165BA7B32712475C87B54156215E9CF31939AE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369418635628125","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369418635628125","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3cefd7d4-b84b-41ad-9089-d89bcacc54fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.977116598297738
Encrypted:	false
SSDEEP:	96:stuWqfgis1Ub9giLN8zETts85eh6Cb7/x+6MhmuecmAeSuq4QC2MU8/EJ:sttesOLNkEZs88bV+FiAMP1MJ
MD5:	DA8BF9BC80C594EC4AE4A9982A2F24A9
SHA1:	D7FD905C3BE16E1AD064016DE76342CA094442BD
SHA-256:	7B64E4D9A0302736B54A5CBFFE1158AA65178601B3A9256C47933B6A13DCEB00
SHA-512:	9F72A35A4913A8E93FE2B67160937E18D2D018D09AEF759B901BEC72129C905DA8EE284647E5F2C16A6C0E4ABC649256E10652EFEC81BC710BD6DE5E17053827
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369418636108691","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369418636108315"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\5ee7302f-dc92-46c1-be24-13986112e593.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.9797261595118885
Encrypted:	false
SSDEEP:	96:stuWqfgis1Ub9giLN8zETts85eh6Cb7/x+6MhmuecmAeSuWQC2MU8/EJ:sttesOLNkEZs88bV+FiAFP1MJ
MD5:	09363B756319A2A7D47684475FDE7293
SHA1:	057CFFCF000822FB78C3A069C7E937A8F573F64F
SHA-256:	F795565A3D04ADE966C8A78F1F4B9381C2944580756409187D9011B90D687548
SHA-512:	C4411A9DC28F1A2C9CF7A003EC2C1B9B836D8E8D64002CCF6C79608C0FEBD0BE0FBA6417871323EAF052B2895724BC6C336F2B8AE4360359AC2930101DBCA441
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369418636108691","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369418636108315"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320496546035326
Encrypted:	false
SSDEEP:	192:6WAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:6JOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	118CA19C8EF671D818F397B53AAA4666
SHA1:	6A1E4ADE3FAAF3A7ED2DA70456D302B96FE00741
SHA-256:	DC6E575D13713E8CE1E9D470B39E14231BFEAE5551B5BC473D8099CB30A113AC
SHA-512:	56F4C37C403248FDD1B0E7AC16DCAE4E55C3312FE3881DB66D29F6BFEECE70B492B1A82055CC09402133183C4A4295C0D1F7D72E7C627282EB42B2C4E2F7C6AB
Malicious:	false
Preview:	...m.................DB_VERSION.1s.Q.................QUERY_TIMESTAMP:arbitration_priority_list4...13369418641125660.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.107720041407843
Encrypted:	false
SSDEEP:	6:N5msq1wkn23oH+TcwtOEh1ZB2KLlL5BTH39+q2Pwkn23oH+TcwtOEh1tIFUv:NcMfYebOEh1ZFL1rovYfYebOEh16FUv
MD5:	00D60F1361AF418E337020518E0689A7
SHA1:	3412AA9E192B971EC334A15CC9A949807EE9B8EA
SHA-256:	6F36B8A06D987DC10BE4FB98B3ABEDC79584CB317EC65B56C7ACD58581AE650D
SHA-512:	2D2FDDBC830FCA91A443F8725C459582127C8545E287A6F67F006F7A57C4C7C06275E97542AEE75BE888296047A827D23C90D758879A72435FD018E73FC3F36E
Malicious:	false
Preview:	2024/08/29-11:24:00.092 2318 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/29-11:24:00.194 2318 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.043968690661486814
Encrypted:	false
SSDEEP:	6:/Fii2+BSXXUkM/lmRtaqhdzJFLydLlcklloKz///lO:dFBitEm3VJNyVL/J1
MD5:	EF613F04BCE943FF4818C9ADDA670D30
SHA1:	9A67E864977D69FCD3AADFE9C91955DDA77AEDAD
SHA-256:	63C5C18245EC4401461DA204AFF5030BC180057205A9A763307933D5F929928A
SHA-512:	5D9CF12158A7CE7BEC91040C414B52B9671AAF1EF0097A52EDA60520F3277BE0CA3E2A9DB974740B4412F706D121CF82A0EB819A48AC3F7BF7B6ECEFAE6A9C83
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09558698758098913
Encrypted:	false
SSDEEP:	24:jUJrqV4XeaPVHNtbV4XQ3eaPVHaHVIRBNUefUAPnQzLIoMEDQzE6DvljpYT38EWn:AwV4XesfbV4A3es3NUeYAEiEFT3lWp4
MD5:	D59636BE262F46DC3F078E73AF22C51A
SHA1:	A22BCE854F93BBA50F6FC12D1AF6229E2B6B6AFA
SHA-256:	4A874EB3D1E49C914AE0A9657D313C6836DE25C7F107F9A7C531E0EA5E477CBD
SHA-512:	46B2903D55A6405DE4A92B474EC301B348199D7C34289632984C398FFFEA06267B2300C09FE6F9A97E8FD31D0914B79E75A6689B33FC0DE2F97C49A7254DC724
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2835302517594908
Encrypted:	false
SSDEEP:	384:/V2qJtMMV2qJtMMjNWmxJt3HSJt3QI84Jtb:/fJtbfJtAAJtiJtG4Jt
MD5:	00ACE2E80574E20E439066BC814D675A
SHA1:	3660C1CE86CAC20C7191BC14EC6BDA63A6DCBE29
SHA-256:	807ED15F2EBAEF77B12E67C685985B90B74EDF683AAE9D32F204A684111F17F0
SHA-512:	5EF81A0A4E567474B17E50FF803BFB94696CF6D53FADE46E59F12876B6E706DD972CF1546D93585FEB7C9E47AD2C640DCEF60E35D012E3EFD75538B4AE8E4F6A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulhPBlt:Ls8
MD5:	7AA00F111DD7A1FF9A96DAA169DAA2DA
SHA1:	3FA399E1B70CE85F8966F00B210E1A532CE4D6E9
SHA-256:	4EA5FA9B8D4C4E45EC545104AF28AA5AE8B5DDD73DD2157B8674E6A6DD444B5A
SHA-512:	AAD06BFAC4644666D41B29FA1105C49680338E545541F8DF2AF7772895B530905FE91AF1013508160E2464B5FC0FE0ADE6528C484764D9E62B137144B48A4B68
Malicious:	false
Preview:	........................................5..Xj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:JLUNAyEZGpl:WNA9ZGpl
MD5:	1B89EF9B2D94AEC078AE9CB1DF7B46EB
SHA1:	BABBEC5FE6FF07C6BB4679415484D15F32844D6F
SHA-256:	4457401D8758D8ADB66E57E28EF10208BA84A98E50C204FAD164DD7B209A3130
SHA-512:	0D82D7D3E567FAC9D197F6D8BE5D88BB80370132D90CE61A10C72AC1D1F160A9127D7CD74E29198204D6EBDC32D762FD7139A300F6B50A3CA4797F71BFFF1330
Malicious:	false
Preview:	(....n..oy retne.........................=.Xj./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:JLUNAyEZGpl:WNA9ZGpl
MD5:	1B89EF9B2D94AEC078AE9CB1DF7B46EB
SHA1:	BABBEC5FE6FF07C6BB4679415484D15F32844D6F
SHA-256:	4457401D8758D8ADB66E57E28EF10208BA84A98E50C204FAD164DD7B209A3130
SHA-512:	0D82D7D3E567FAC9D197F6D8BE5D88BB80370132D90CE61A10C72AC1D1F160A9127D7CD74E29198204D6EBDC32D762FD7139A300F6B50A3CA4797F71BFFF1330
Malicious:	false
Preview:	(....n..oy retne.........................=.Xj./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:LbHAyERv1:49Rt
MD5:	15E0B42F54CFAED3382B59149B8A3F43
SHA1:	C5932817FB9E1E79ED18909C3F58D492C6238EE3
SHA-256:	C399BFA9A0C4CF6033F69CA948073B977AB4EA28B05DC6DCE4F289C6612C73A5
SHA-512:	C1383859BC252754ADDBE4BE9A9B707EFD6C0FF13C74A6153A03A22643AE18F48A383EBB8F968DFCDB1205A2FC497CCD1FA193B0FA3347663CB4774997056CFD
Malicious:	false
Preview:	(...V>.oy retne.........................z.Xj./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:LbHAyERv1:49Rt
MD5:	15E0B42F54CFAED3382B59149B8A3F43
SHA1:	C5932817FB9E1E79ED18909C3F58D492C6238EE3
SHA-256:	C399BFA9A0C4CF6033F69CA948073B977AB4EA28B05DC6DCE4F289C6612C73A5
SHA-512:	C1383859BC252754ADDBE4BE9A9B707EFD6C0FF13C74A6153A03A22643AE18F48A383EBB8F968DFCDB1205A2FC497CCD1FA193B0FA3347663CB4774997056CFD
Malicious:	false
Preview:	(...V>.oy retne.........................z.Xj./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl2Ha/:Ls32Ha/
MD5:	3C72A05C6C23FB8FE5E168B09A5F2187
SHA1:	1A05ADB87865410F409937186F6E0E7B07B65C29
SHA-256:	23285297B1F697DF2DD44AF7FF6F046D6C92073C5C175680B5073B5A0DB42611
SHA-512:	0AFADB0AF5312DB644162F1E2CD5BF09EE274F7A2E96C1834AFCFB53CA36FA7F069BA85621DFC54F178592C7F38256BE45F8AAEA5EC3A4E78B19DA3DF34E2334
Malicious:	false
Preview:	.........................................(.Xj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3541628823415355
Encrypted:	false
SSDEEP:	6144:/A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:/FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	768933C74ACC807CC481BCE2CAE6BFEC
SHA1:	FD759DCB91F0F1F9655EC058DAEFCE0ADAA35B73
SHA-256:	7C7E3AF2DF787BD2DBFB9B2831E6D8A0F5ECD889B2343BEA672B8DF7C5A79C24
SHA-512:	1DE9397A4520FE0E0BD01367370A3110C92BA16FCF86597C2FE6D2A1429D35243EF682290C633430EBFD88340AC09EE0AF78E6FF58B077BBCC3324C28E92036D
Malicious:	false
Preview:	...m.................DB_VERSION.1...q...............&QUERY_TIMESTAMP:domains_config_gz2...13369418641128054..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.194156549710899
Encrypted:	false
SSDEEP:	6:N5mrWhM1wkn23oH+Tcwtj2WwnvB2KLlL5fIq2Pwkn23oH+Tcwtj2WwnvIFUv:Nc8rfYebjxwnvFL1evYfYebjxwnQFUv
MD5:	54F8D2713B98E0ABB2C581584131FA95
SHA1:	45D2A8171A6E5E15CC78F5FF2A5B4BD90635B21F
SHA-256:	3A7BBF9BACC3E9FB584439C4E7E0B94DFD6C9DA9261C318B6596C5567C8190D3
SHA-512:	1A5201E106A657057957D772E409F5BD8C0B578BF45745C0DD5C93E7B01950B29529D539E434C1BDA195D6F0961040E26B14D50E5F154179C2416C3EDD7F3890
Malicious:	false
Preview:	2024/08/29-11:24:00.094 2334 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/29-11:24:00.172 2334 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324619952571439
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rd:C1gAg1zfvV
MD5:	C55FDA97F1C195CF6085AB6AB65D4783
SHA1:	25F52B567B9F861C4F909CC7D3E45017F4C146CD
SHA-256:	7D8B02363843C4B2717B8575234FDBA062E42B8B005BC0154B80001DC6336E43
SHA-512:	ADBBEA25C673C9F552935BC8BA8C91EB8E3504A63F87CA7B1F4B3896DCCB7166DD0CD7FD22CE81CEA30AC8E31870511692C94116F1E7C0907F7CD658E90E1450
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.235651385251053
Encrypted:	false
SSDEEP:	6:N5scWUDKHM1wkn23oH+TcwttaVdg2KLlL5scnRN4q2Pwkn23oH+TcwttaPrqIFUv:NGjUDKHrfYebDL1GkOvYfYeb83FUv
MD5:	A9CE0B72CF8BBC8355BD1A5B784105D2
SHA1:	2B51C82CBCB1932D1176CA549B90B94C3E35CB2F
SHA-256:	8BE46D77E2991247A26ED88D2C29827625B6C187B63EBB6F0B9A80AE0386BF02
SHA-512:	1C06637819254494A468C4389C8A6184CCE33FDCD096E6F6D955AF298E01F1C7B4676F8A5A83659445E5D321643A72EE06AA8716740D8050453CBCD9DE6F800F
Malicious:	false
Preview:	2024/08/29-11:23:55.741 1f84 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/29-11:23:55.794 1f84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.237591670133254
Encrypted:	false
SSDEEP:	6:N5scCHM1wkn23oH+Tcwtt6FB2KLlL5sS5S4q2Pwkn23oH+Tcwtt65IFUv:NGxHrfYeb8FFL1GSnvYfYeb8WFUv
MD5:	19661DA1AD68399429AB95E05C3E6FAF
SHA1:	ABF0EEA44C23E89A4D1ECC6060BE86565CA2ABD2
SHA-256:	1D306A7DE099CE9767720E2C55ACF3EAC6DC0AD564A3C78882F3E7BE43D95514
SHA-512:	6A3414F369C80A93B0A9E3960E498444265892F53812CEC332584473397A14292F6E120C52A04E8BBB92326C194E9F880EEC766C868D1316A5F007DB3017DF98
Malicious:	false
Preview:	2024/08/29-11:23:55.796 1f84 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/29-11:23:55.906 1f84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.208543426670529
Encrypted:	false
SSDEEP:	6:N5sLj1wkn23oH+TcwttYg2KLlL5spm3+q2Pwkn23oH+TcwttNIFUv:NGLSfYebJL1GpC+vYfYeb0FUv
MD5:	8A7FD1E55C6E73F7C45630FFF349D575
SHA1:	449473FCF5F1F0EAB8E531B48C8E91050E92080C
SHA-256:	ABB62CED64BFBC85750E470B43C6701F60DBFA7F37C028C57FEB461571E6C19C
SHA-512:	75508461513A32DB4337CBFA16705255F1716EAAE521933F734D2E8CD91919BC246642B01DEAFFCC4F523F5ABD7AFA98BB6B6043C57157AEAB06277692B562E0
Malicious:	false
Preview:	2024/08/29-11:23:57.362 1f3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/29-11:23:57.372 1f3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlOv/:Ls3u/
MD5:	1C8BEC93F55A3DAAC934AA4343499DDB
SHA1:	0A66F02BD67048006647BC875911C4533A318FCB
SHA-256:	F247848CD022FAEAB30A96D7640272A34D0D1258C049F1B78559584F776AD4C8
SHA-512:	4AF16AFD252F58D6C5B35143FDB468272EAB15E225A3048A92C2DCF6B9E70FF9B697EFB183C9712BB81ECA16B1DCFD6E8A2B890228AD0DED49FCC9E028575A99
Malicious:	false
Preview:	...........................................Xj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21767183608283716
Encrypted:	false
SSDEEP:	3:Nl7ntFlljq7A/mhWJFuQ3yy7IOWUv/4/dweytllrE9SFcTp4AGbNCV9RUIXi:Y75fOdQ/d0Xi99pEYNi
MD5:	1DB9EAFA92CFE375B2D00CEE6DBAFCB3
SHA1:	742AF2C36FF684D61EBBD8A9AFB091678D2147B4
SHA-256:	9EB49C6C71838A110D4E8DA3301C9C9CE89CC76146CE140330FC8FECC071DC39
SHA-512:	F3F247B463276AD4DC757535726B30D2EDBC8D8A115C41CED53157953CF087A235D60B0166DEE26A0AB283A557F9D5D10189BB987A9EA12BEF23151B99D47CA2
Malicious:	false
Preview:	............bm....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.2492651177892045
Encrypted:	false
SSDEEP:	6:N5sOcXHM1wkn23oH+TcwtRage8Y55HEZzXELIx2KLlL5sUXq2Pwkn23oH+TcwtRz:NGVHrfYebRrcHEZrEkVL1GUXvYfYebRz
MD5:	9350A8A8D1953659DF090BBC5851296E
SHA1:	43264FD453C7D89A321EA7266CA9E785F45E89C6
SHA-256:	D7BFF6ADABAAD5BDCAC0EBF126994716C63BE98453B1CCC0E61F5CF4EDA0E03F
SHA-512:	6C4D5DE76CED12C7133794670BA6C7693AFD2A29D7FFE8476E9FBF605313CA16FA037A145AC170F402BE77A1D0C8A43D58C87EDA5FBDE2D489876FC2663BB2F7
Malicious:	false
Preview:	2024/08/29-11:23:58.329 1f34 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/29-11:23:58.340 1f34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.224623761944931
Encrypted:	false
SSDEEP:	6:N5sSjs1wkn23oH+TcwtRa2jM8B2KLlL5sSTTpM+q2Pwkn23oH+TcwtRa2jMGIFUv:NGSXfYebRjFL1GSTlM+vYfYebREFUv
MD5:	F5C50A1AF77EFFDCA25FC435AF2CD2E1
SHA1:	C7A58CF1046686C97B35748027FE8728BDCD3A13
SHA-256:	C66CAEFF531A38C5DC8B55C9240FD6B83879D3943D5AC456EF315EB22660BB56
SHA-512:	B0FA02511388DC5B84B797844FE3E556AE1844A25489620ADF6A3071FCE31F7D5EEBAA1BB9A11802D9F207B91AF2FA7C8FC0539EB43676C34A3354ED4F9259AA
Malicious:	false
Preview:	2024/08/29-11:23:55.951 1c8c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/29-11:23:55.984 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\31ea4d0c-0c8a-4f66-8c62-028ec3b23760.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbRHeHBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ubIa4MS7PMVKJTnMRK3VY
MD5:	633DDD1B4920EC5BE074DBE9C025C0CA
SHA1:	544DEC5ED8BD3FBAB234940BEA45390B5CEF13D1
SHA-256:	8FCAE56F81D49DE83AC45BB8848E818C99462EEE03D017124E895D39630B3889
SHA-512:	CB89ABA6C2D59A7D520BD1BBDB85CBDF5CFBBE3DC9DFD02E06071F8597E3EB0D3B3BE3587AE58870B92127379A2C875A856F11B6792D4A68C5204837814549A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\32e6a490-7935-4efe-a794-ab5b20f401af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\3e453873-7ccb-473d-8ad2-26bdd32854bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\411ff5dc-a07c-49e2-9ec1-becb6d7e4cef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\926c4f6e-d702-4939-bf75-5330acff1c3c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3ae23.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7606700355527494
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkZ1:uIEumQv8m1ccnvS64v
MD5:	F51FF18E125F7EBC5FA1CDF98AA75ADE
SHA1:	87BF6DB4EB9DE5D7D22C84D98BCD9B46965D0E55
SHA-256:	3467C158AC46810E92A6F874B8BDD77DB4B2A1BEE6C262A7777815135458B354
SHA-512:	1F5902FA37886AD341CD6D9391FFD2286CAC18D504BE50AE7F69CE94A6DB0A4C25736B6425E623A260DAD0B4E633E9C98260694D20515A6B9638B57DF162A3AE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF290ad.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.969597165840149
Encrypted:	false
SSDEEP:	96:stuWqfgis1Ub9giLN8zETts85eh6Cb7/x+6MhmuecmAeSxq4k2MU8/EJ:sttesOLNkEZs88bV+FiA+P1MJ
MD5:	7068123DF6FDF72656808E353BE9011B
SHA1:	99C35A0D1073E7C18C0E4F690CE7C8FFFB399E55
SHA-256:	76F52E8255C2E51CD7C8B996F30141AFAD70D28542B8D5FEBE29F1B1BF5AF17E
SHA-512:	5183AD58147E1FDCEF4988AD7D587BF58CAA3C637395912724C161BA3AADD7781FE8D48877774C737F37551B4576F803AC836294BA130174338A91BFC33B9648
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369418636108691","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369418636108315"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF321a2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.969597165840149
Encrypted:	false
SSDEEP:	96:stuWqfgis1Ub9giLN8zETts85eh6Cb7/x+6MhmuecmAeSxq4k2MU8/EJ:sttesOLNkEZs88bV+FiA+P1MJ
MD5:	7068123DF6FDF72656808E353BE9011B
SHA1:	99C35A0D1073E7C18C0E4F690CE7C8FFFB399E55
SHA-256:	76F52E8255C2E51CD7C8B996F30141AFAD70D28542B8D5FEBE29F1B1BF5AF17E
SHA-512:	5183AD58147E1FDCEF4988AD7D587BF58CAA3C637395912724C161BA3AADD7781FE8D48877774C737F37551B4576F803AC836294BA130174338A91BFC33B9648
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369418636108691","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369418636108315"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF396b3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.969597165840149
Encrypted:	false
SSDEEP:	96:stuWqfgis1Ub9giLN8zETts85eh6Cb7/x+6MhmuecmAeSxq4k2MU8/EJ:sttesOLNkEZs88bV+FiA+P1MJ
MD5:	7068123DF6FDF72656808E353BE9011B
SHA1:	99C35A0D1073E7C18C0E4F690CE7C8FFFB399E55
SHA-256:	76F52E8255C2E51CD7C8B996F30141AFAD70D28542B8D5FEBE29F1B1BF5AF17E
SHA-512:	5183AD58147E1FDCEF4988AD7D587BF58CAA3C637395912724C161BA3AADD7781FE8D48877774C737F37551B4576F803AC836294BA130174338A91BFC33B9648
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369418636108691","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369418636108315"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565614201248013
Encrypted:	false
SSDEEP:	768:uAqB7oWPKwfRU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnCPFDrwrVpGtuv:uAqB7oWPKwfRUu1jamyF4Wto
MD5:	B9240EC246B87A402C32CC0D01FA50C6
SHA1:	ED41A825DB383DDF792B4E3893A99CD09D797625
SHA-256:	B2507BDD5DD58687BC4123FBF6CC9A03D9CC69264726CD21A2124096A5ECEC9B
SHA-512:	1D0FE602B785FF200B13A00E41888CB8673D58F1DD1F4FD001250157DD38B8FF06241220912087CEB60951CC72165BA7B32712475C87B54156215E9CF31939AE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369418635628125","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369418635628125","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2f11c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565614201248013
Encrypted:	false
SSDEEP:	768:uAqB7oWPKwfRU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnCPFDrwrVpGtuv:uAqB7oWPKwfRUu1jamyF4Wto
MD5:	B9240EC246B87A402C32CC0D01FA50C6
SHA1:	ED41A825DB383DDF792B4E3893A99CD09D797625
SHA-256:	B2507BDD5DD58687BC4123FBF6CC9A03D9CC69264726CD21A2124096A5ECEC9B
SHA-512:	1D0FE602B785FF200B13A00E41888CB8673D58F1DD1F4FD001250157DD38B8FF06241220912087CEB60951CC72165BA7B32712475C87B54156215E9CF31939AE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369418635628125","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369418635628125","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.144185402478706
Encrypted:	false
SSDEEP:	6:N5MFvs1wkn23oH+TcwtSQM72KLlL53LlM+q2Pwkn23oH+TcwtSQMxIFUv:NyzfYeb0L15LlM+vYfYebrFUv
MD5:	4AAA664CD28AFB53C01A5F6CE8068A70
SHA1:	DF4247234AAD72DEDB253E4753F69FED9FBC6251
SHA-256:	C47E125D0AC1D39186C6A34BEAA84FA54791EBC9668752154E1F5884295EA229
SHA-512:	007CB7DFE4B2FFF7BEDC2715183210FFFF0E33D581D5ADE17FE92B083E7B9EDF38EC7DF9563E61727D8D7E595A65F9808A1B4464A8D9E7A30FB5922B676A8C82
Malicious:	false
Preview:	2024/08/29-11:24:13.193 1c8c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/29-11:24:13.217 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.163525193301785
Encrypted:	false
SSDEEP:	6:N5sZUDKHM1wkn23oH+TcwtgUh2gr52KLlL5sz4q2Pwkn23oH+TcwtgUh2ghZIFUv:NG3HrfYeb3hHJL1GUvYfYeb3hHh2FUv
MD5:	B5EB7DDAFEF2C3B8F681DFED0253FA58
SHA1:	B50CF5DC3B3ADEA3D18E98E7BB5BB336AC2FA5B0
SHA-256:	5DB6EEEFE72769BFA1A1C349B4E07C0284D4F0D6E7403EDF8939370CDDF2F028
SHA-512:	33A06C467DE35D34E045B89B26A497EECD59C2A2D684673CC6418CE5422B0D036A840C4F52C5D86FBA34330D20693641E74D2597D0113D8AEFFBF8D6FD9F0629
Malicious:	false
Preview:	2024/08/29-11:23:55.606 1f84 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/29-11:23:55.634 1f84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsulq:Lsx
MD5:	4293E2329FBEBC31CD8165E7D29A4346
SHA1:	28419801308F69D6BF002BAEF6D55E142FC5E3AB
SHA-256:	077AE2D91B4867BA65A5136E1536358E224BE883444AFD09C0927D66619249C7
SHA-512:	D93E0050E4B1B9171DE42CEBDF352A1274AB63C3FB5AE6A024CB548CB24995884AE927BB75C945404F1454E0EA64CF111B9407EC7AD719222C62D27224B61761
Malicious:	false
Preview:	........................................N:.Xj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:kKHFX00EzdT:kKlwzl
MD5:	D135CBD78F908599B0330E0BE7EB09E2
SHA1:	43D331E4CE62211BB07E4208DDFECBD4E21C0965
SHA-256:	6B3BC67331D4E67B435DF3D57D799D3D07477D0E9AAEA634D6505630BAC87788
SHA-512:	43582ABEC514166A7C7235B36772D6577F50ACF72244DFC3D670A84C4F88D6FA4D630A8FCCD9A0D115634163E8770CC8B558CC70FDBEC8355B0B8A3680BF6C60
Malicious:	false
Preview:	(...y1.Coy retne...........................Xj./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:kKHFX00EzdT:kKlwzl
MD5:	D135CBD78F908599B0330E0BE7EB09E2
SHA1:	43D331E4CE62211BB07E4208DDFECBD4E21C0965
SHA-256:	6B3BC67331D4E67B435DF3D57D799D3D07477D0E9AAEA634D6505630BAC87788
SHA-512:	43582ABEC514166A7C7235B36772D6577F50ACF72244DFC3D670A84C4F88D6FA4D630A8FCCD9A0D115634163E8770CC8B558CC70FDBEC8355B0B8A3680BF6C60
Malicious:	false
Preview:	(...y1.Coy retne...........................Xj./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:6z3dEQziL:6GmiL
MD5:	55BC222071F960027F0539F86CD414DA
SHA1:	8A6BE155D190512F31D417E06B306E822583D93B
SHA-256:	F7BA8AB2EEAF67AC57E646DF3C2949781B0A8AC45993BC48B0C90E0227032601
SHA-512:	70E35B8AC554D8742FE005C20AF7FD77AE469154F7F1D747E9969D4ABDE6957FAB16B170350A9683A1A16FFE229E98BE2362AD83AB8C1BB55C9FDB0B37CCF845
Malicious:	false
Preview:	(....7.oy retne...........................Xj./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:6z3dEQziL:6GmiL
MD5:	55BC222071F960027F0539F86CD414DA
SHA1:	8A6BE155D190512F31D417E06B306E822583D93B
SHA-256:	F7BA8AB2EEAF67AC57E646DF3C2949781B0A8AC45993BC48B0C90E0227032601
SHA-512:	70E35B8AC554D8742FE005C20AF7FD77AE469154F7F1D747E9969D4ABDE6957FAB16B170350A9683A1A16FFE229E98BE2362AD83AB8C1BB55C9FDB0B37CCF845
Malicious:	false
Preview:	(....7.oy retne...........................Xj./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNla9pX:Ls3a95
MD5:	E88EBF13D6C47DB38418E3BC87B5D79C
SHA1:	81374775D55D67B9BBB85CC8475563D6E8D59C72
SHA-256:	C778DA1EB525823DE8C0544DC52A2F8FFA986E8C0F223F9ED3E7EAE0EF53DC38
SHA-512:	ECB037FC70F86E92A70E213E89E394E6EE5CC6E01CEB8FC400E5E3BB5F6F4C38955DF552A4EA426AF6B23EEF8F351704F891057D712E7E5305A2D4CBB884C6A0
Malicious:	false
Preview:	........................................7<.Xj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl9a9R/:Ls349R/
MD5:	88EC4721BF6BB858170EAA4849F48227
SHA1:	D01A66B960D9FD2119705316C052FDA63622AA10
SHA-256:	5C34B18070324FC5FC7B6FC94BB616CABE9F13E12CF61808520DF25CC18DDDF8
SHA-512:	2D0F9897B823810DFD5F8DC2E550861308699F5909FFBB15E0501D38F101FEA6E243E3F7DBD0ABFA47EA66DC72CC6668626014CAFBFE0B66542BF11569E0E5F7
Malicious:	false
Preview:	........................................\..Xj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.241967675685793
Encrypted:	false
SSDEEP:	12:NGhSfYebqqBvFL1GZGFIvYfYebqqBQFUv:NGhSfYebq8L1GZGMYfYebqZ2
MD5:	1C8010CD91D7E43D63F62AD1677AEC2F
SHA1:	A2B94FEDD8881F748140DA54969DCCBC57AAD1DF
SHA-256:	AD5B386D71B364A5FBB26FADF0CAD6734D0A0CE08CD6218E2D87314F57ED8C5B
SHA-512:	0DC68F571114C0E5B42CE247D12F20233F446C59DB897BE4CB0C225C3F2EEBD1980ABA9F73576838649233552710DDE40B21A7CC178884C0E3DCE2268B807EEC
Malicious:	false
Preview:	2024/08/29-11:23:57.412 1ca8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/29-11:23:57.479 1ca8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\08560c97-0e60-4041-90f6-b6647b151d57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6272e290-593f-4009-bb17-7587bc2c2b14.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3af3c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c5ee712e-68e1-4c69-84df-edb6d5e26079.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f557266c-719b-40da-9907-f77537a9bb01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.211156218026355
Encrypted:	false
SSDEEP:	6:N53XJ3s1wkn23oH+Tcwt0jqEKj0QM72KLlL537GjM+q2Pwkn23oH+Tcwt0jqEKje:N5XxfYebqqB6L15CjM+vYfYebqqBZFUv
MD5:	8D3FD081129BCB39FAA3FFB58219D410
SHA1:	C1B669143E7B9A10491F48547FBDD138A8EB51EB
SHA-256:	AEB50422B38772E8B857632E419C02D7A5C8D4F21526CE7531375725FD4325F5
SHA-512:	F1BA0152A8CF046F767BCD5006F5DDCD0C1CE96E48F431536B73199DEA5F7A7CB21D189EB3DB6101CF5CE8746202C539BEAEB67C88F683200D38DDD8A9B944FD
Malicious:	false
Preview:	2024/08/29-11:24:13.235 1c8c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/29-11:24:13.263 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.263784326144246
Encrypted:	false
SSDEEP:	6:N5scD1wkn23oH+Tcwtkx2KLlL5sS/W+q2Pwkn23oH+TcwtCIFUv:NGcyfYebkVL1GS/W+vYfYebLFUv
MD5:	9BD94BB80715DA4B7C10C21D09FC80B8
SHA1:	08D8ABB4FF2F606BA5C71B355F21CE42C9AA066C
SHA-256:	155B11DE8A411B1540C60749F2F80EFC556F03ACB0932D9F07208A1A78D19074
SHA-512:	8DA2E57D9C1A7323D9946DB3FC128C396D2565923AB9B148B1A73281D50B4B84E59E9037899F6DE87B96ECA96F5C275CFA4DD4BA6826A6CBEC6110E708840EB8
Malicious:	false
Preview:	2024/08/29-11:23:55.613 1f7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/29-11:23:55.900 1f7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVZl:IiVZ
MD5:	B5FECC4AA1BE2275AA6F3E4C58C66D9F
SHA1:	6A1DB81C2E9B26661733B345D7AF7EBD02B8F6F4
SHA-256:	D9C76F1DD69C21455E8D0FA21ECF60927B6C9DCF30ED8DE31291D3DD3A1E55F5
SHA-512:	8A167850137A1AB528E3C27BEC82D3721B76BE6D2538E6B043FF73ABB7B9A42123E090168772D971425D847C29F0F0FDCC48F0585B6816D6F130CA38D3707ADE
Malicious:	false
Preview:	VLnk.....?.......g..a.5................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.077208294998823
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkO4SAE+WslKOMq+vVumY0pn66:e/2qOB1nxCkO4SAELyKOMq+vVumxp
MD5:	2541702B52DAA49D73E10A574EE73B2C
SHA1:	6C0A6E5085444EA4F07F8115BF9BBC77087A1EFF
SHA-256:	33F65240894065DDAD56286A37537D3B2A346D98DBCF06588D083494E36F1A45
SHA-512:	88DFE6EFE34B01CEC616305042ECB0435EA3C8FBBDFC2ECBF86526502CE254B3118E87620BAC34AD2D114C9880D0B47696A9FECAEAC46CC77307DEC6286E5C39
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ae1d3d41-14c7-4b6a-8478-109443e5f417.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.565745325622207
Encrypted:	false
SSDEEP:	768:uAqB7oWPKwfiU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnCPFDrwXVpGtu8:uAqB7oWPKwfiUu1jamyF4ytb
MD5:	95BF0CDCA1FF50F5AD2B1DA9589C6BAB
SHA1:	92D9451BE42DE9436872233C69ABD4358DC9561F
SHA-256:	15C5B4CE084E16AAA9610F76EF4F8CE3C27290F481FB849EBD729BE300E183EB
SHA-512:	899B4E0CA7ADB5C7D6AA97A6F0F696C9BF342F6B4707DD9F6BD2ED134857D2D158C356C2BBBC1D4BF8229A778986327EF472A7FE05E1B5C18EFEFF640030AFCE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369418635628125","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369418635628125","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\b53bcffe-8ced-4d7c-85fa-77a1c17c1c00.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.969597165840149
Encrypted:	false
SSDEEP:	96:stuWqfgis1Ub9giLN8zETts85eh6Cb7/x+6MhmuecmAeSxq4k2MU8/EJ:sttesOLNkEZs88bV+FiA+P1MJ
MD5:	7068123DF6FDF72656808E353BE9011B
SHA1:	99C35A0D1073E7C18C0E4F690CE7C8FFFB399E55
SHA-256:	76F52E8255C2E51CD7C8B996F30141AFAD70D28542B8D5FEBE29F1B1BF5AF17E
SHA-512:	5183AD58147E1FDCEF4988AD7D587BF58CAA3C637395912724C161BA3AADD7781FE8D48877774C737F37551B4576F803AC836294BA130174338A91BFC33B9648
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369418636108691","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369418636108315"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\c1094ad7-52e1-4066-b1ab-0231873eea54.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\deef0e5d-a325-4d5d-83f2-d68a005cf7d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/4ulltl/lFll:7+/l/L1
MD5:	F26748E87F4952A8D48AFB4A73EA94B8
SHA1:	FD959AC2878FCA344EC25C56D3427AB6F513D39C
SHA-256:	6ECB140DA6F963180C1D9EF67E0B53F7CCC780BAFBB2E9C726D374697BB70F04
SHA-512:	DB4D5595B6325ED771E515F8D9AB5DAA1A68E9F3B2082CCB986239EA92FEF5C61963881E75D32B3E3227F36101A8AC0AE53AEF6F8B3E963445DC84A53093D9DA
Malicious:	false
Preview:	.... .c......C.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04998394447396411
Encrypted:	false
SSDEEP:	6:GLW0ffYpZLW0ffYpY/CL9X8hslotGLNl0ml/XoQDeX:affyZbffyYyGEjVl/XoQ
MD5:	C8E79D4439A45A86079F9631C57CDDAC
SHA1:	0914F1CBDF396A16519AF647CAC81E1966441A92
SHA-256:	F550A988A4DA2598E553F457632BECC387315D47766E475080780E5CB1093657
SHA-512:	D4ABCA8A3EA041FB9C84FD82C07992DDE94E181F0041BE3FDBB76BC6BE17298BF7FC4FD9F891F06AB56B00E6CB9D9F60F46C9C092753F2CF36F69CBD9F815F96
Malicious:	false
Preview:	..-........................r.......l.A..f.x.....-........................r.......l.A..f.x...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9977250937341499
Encrypted:	false
SSDEEP:	48:FzxplO+/wfcbX+uvn9VAKAFXX+DZ2VAKAFXX+IxOqVAKAFXX+nnUYVAKAFXX+RX/:Bxd4pu8NsbNsSO5NsWNsRX/
MD5:	511EADE4AD68750A70562D344A44F855
SHA1:	3C05B6DDAB1B196BC4F463A2B19A8AAEA8F96EF2
SHA-256:	67F049B6F38EEA99C1EE0E8DABAAB3B34548D06BC92225CBE7919873D2097AE6
SHA-512:	E9C842FEE3610BB30F1BAFC08D73503AD711A79DF1018F1723290B1427DD4D65F10F7A6BA14D71205BC3BDF70F6D959371507A6766DCE7D1C305927D95A0E513
Malicious:	false
Preview:	7....-..............l.A.t.....?............l.Aq~.m....SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.487881216745698
Encrypted:	false
SSDEEP:	48:r8wSBSoQmPJHRHlxTIYjIYVzVqkEMYjMYzyGAlkfAlkq3P:20oQAIYjIYVzVbEMYjMYzYcYH3P
MD5:	F4933ABB0FBEEE604AB098E94DDCD514
SHA1:	0086621D4DF25774B45617CC463563E5712FBB3E
SHA-256:	4E918FDAA9D133ABD67097B1865EFBC579E5F354896AADE2A8723EF8749A58E2
SHA-512:	BF97E784E34C1F579B50B889B61E6A2835C100B89EE38D97688DCA02916065EB4262B37C6EEA6E6B8379076EE67087152266E973BB84C347F6421BC7CD6A4787
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1....................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.296770990541085
Encrypted:	false
SSDEEP:	6:N5sNV81wkn23oH+Tcwt0rl2KLlL5sN9Oq2Pwkn23oH+Tcwt0rK+IFUv:NGrfYebeL1G6vYfYeb13FUv
MD5:	13DC1029BE2C2EAE0C1ED079C1E45790
SHA1:	9B89D014AD3301967E481677F9E0035006ED9A2C
SHA-256:	E125119D2F6C9B0112263345D63901FC4BD536F0C538E9D577CC08F352CC54F0
SHA-512:	9A6C9F23B3DAF7EC330B26DC50E4F916BCC27A47673C6429DB4F38632C778B54C7E64935046989DDD89741358E418A93931A75304075975B1DAA324E896EF499
Malicious:	false
Preview:	2024/08/29-11:23:56.138 1f70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/29-11:23:56.153 1f70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.958141412815535
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Wui+it/4JbZfPStub/RG0lbANqa:G0nYUtypD3RXi6FZfc25m
MD5:	FBC524D02048C176A0A5D1B8B752932A
SHA1:	294C48557549A4C978326D9B7969E293A024F157
SHA-256:	F3FC95AE128DB918FC126F15CD9D96618482BA6ACCC622AAA19B10CE80B15EA0
SHA-512:	9B6434442E11610B8B5DDA43AA56656599925C9C8F0A364DDB69D15B37A912D223EE600012468E0DB723CAF3546FFBDF56F085A0159EA7968BBACE894AAFF856
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................37_.......`.................38_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....:.=..................3_......W2..................4_.....)..>.................37_..........................38_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.254561185264512
Encrypted:	false
SSDEEP:	6:N5sND81wkn23oH+Tcwt0rzs52KLlL5sN8Tq2Pwkn23oH+Tcwt0rzAdIFUv:NGBfYeb99L1GGvYfYebyFUv
MD5:	5A328DDEEB73173CEC9C671484776536
SHA1:	CAEC91D2670356BECED952D9B74CA98207B5B60C
SHA-256:	7E4B43983B4DD6D90F4F5E0B9389612C821554E16153A7CE7BB652971608B7DD
SHA-512:	F292621FA5D4364A0A897B8233A8A6600EBC5E522E21D7896796565AB83F61444762F0EAAEA52A1D77BE03CD1DBE2D52B7922B15652AC879FD20C401D70C111B
Malicious:	false
Preview:	2024/08/29-11:23:56.114 1f70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/29-11:23:56.135 1f70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl5H:Ls39
MD5:	46E64829123BFF6EB31A08F504EC6D4F
SHA1:	84A5A5FE3EA711AC899336A2523BAB9872C480CB
SHA-256:	EAA94A5AD191D8D95D757C3A352C5C7568B2474265C25FF9F3A0195C7852740D
SHA-512:	8E737F95A60927E7DF96F89E76D1CE0AD536BDCB1E36D53CBD2BD825D2E02E9C4F234C81FBD1D9181687E2EAD4534E8E36A57FE26ACE122ADCA13449431CDBCC
Malicious:	false
Preview:	.........................................2.Xj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlKiKX:Ls3K5
MD5:	B314D920E9A0D2E0793F8C874FFD5112
SHA1:	03C8C3DC81FD9AC3015F1AD6A4321A2870395159
SHA-256:	2FD9A0D529C25743CCDE2842AE52808113001291ED88D8B9FC68CD2C6235DE80
SHA-512:	9933EE367742A2F5343CBA71E2EB8F9DF280A15366A4D517262884AD11E77575F1E1DA7199F7AF9152E47CF9DA54A146BA39AAA31AB6C8B39B1E367A94D1CCDE
Malicious:	false
Preview:	.........................................:.Xj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF283dc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28562.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF285df.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2ace0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2e67e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3371e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF36f84.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF396a3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3f59c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.534502382857722
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtXaP6IZ0fXBVdxLyikFJdXBuBuwBfa9XHnNhKgWfXEErQQRCYh:YuBqDPafwCk0fRVTsgBzBfETKgWfcB0
MD5:	E08CAEEAEE55CD3C78CC60E07C5CEBD9
SHA1:	41A63544F13AC0A46FAE2A9A0C2C57298B440299
SHA-256:	5C446BF22ABBC5277C537DA2FA126A50A0812B337E5ED4006FF6D1ACBAEFB932
SHA-512:	DF3F5D306EA629705435C95F846B8E7F993A7F6934D4BEEB89BCFC0E090B2178C90CAD16E3AB2F085CB4F2B11F861CB32E574D4BDEFF26EFEEFC0386B0EE9AEF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwroAzBg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369418635087284","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724945034"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlgl/:Ls3gl/
MD5:	3BBE116397022BB13AD04D4420F2FC1B
SHA1:	7840191AFCC6E4883DB9A0866FED0A2D354DCEA1
SHA-256:	AA3E23411E2D4709CE05FE1CA0BB873ECBB64DD8A865F3EFB27E7421BA5ED41A
SHA-512:	B10C723E2DF2458D9C8E3DF3D090160DB02F2029519ADF0BE2F6EE2F3A37FFD7CC5829DC65E8BD4E5B7DE508E7A8E52B51BDCDA261EE5D1626B9C39EBD9A6D01
Malicious:	false
Preview:	........................................C..Xj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\c34d660a-ffe6-45d5-8eca-68588f33e64a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4234
Entropy (8bit):	5.499754080613135
Encrypted:	false
SSDEEP:	96:0q8NkGS1fwCk4RV658rh/cI9URoDotokDB87vREWy1JkTcEVSDS4S4SDSoI4a:/8NBSyCkYVTeoDUFHt7kTG
MD5:	9AF777A94F4BA1CDCDFBD6872F62B848
SHA1:	1E8F60B26F21294865018D01783498A21163B8F0
SHA-256:	BEF42D207AE6332D8B282ECB2FD5251BF51998127DD740508D0BA224FF30D2D2
SHA-512:	E6FF3D1CB0D3ACCA049B73A4E0FE277E82938EB84E9C9BDD6EC61CBDBD0E2BD90C3511B2979096AB3F93A3725ED6D7740D44013A169E72D2FDE1D20273E55434
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD7eaSAdFDRG86mxcqs96zKV/u3NA7aDx9Pz9uF8zToqwAAAAAOgAAAAAIAACAAAACUcTp31lOx5JW4v/EcLLqRrgPG7EygAzdZggoUFFkpmTAAAADt4l3fg5q33YFSwM7TRCXb6oVmvBAiqt5r6b2+IHIVUGfC0RPOyPAek8dMX64YJbJAAAAAr6hWK/DbQIRFRvnZ5ajv6R89VnpNdVzwfTz3u1tEoqR6WeJ559vG5fTJGJdMbKRJkVvsXzv081y7hSdwr

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\c67456bc-bad6-4668-b753-4eaf643f4982.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20994
Entropy (8bit):	6.064793083359808
Encrypted:	false
SSDEEP:	384:xtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSE46kYV4RZ4TV+Mh0lkdHd5qV:rMGQ7FCYXGIgtDAWtJ4nI46kYyZ4Tphq
MD5:	AAFEE18EC26C2A3DD662F668D01F4B02
SHA1:	D3D4D5FA590466790D87D8729DFBBCB60192B363
SHA-256:	62B59519123AF723C30FFBC25AFD089666F936376981ACE28EE8CDF21AB1D98C
SHA-512:	E50B2EEDFD1F058D045B053286D4CDEE43208A87724B05AC86F7C497E19669F76DC65A778451E61B30B859FB47FE6E134845501D27977721D1CAFB3F541CE6AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369418637136918","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e96e3e3e-7d9a-4cb3-b8ad-13e5d153c2df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71183
Entropy (8bit):	6.072844037166167
Encrypted:	false
SSDEEP:	1536:rMGQ5XMBG4dJxQjVor3WaO/mJTpm0bSis90eWLvm54luGe:rMrJM8eJcWWaMaC70eWLe509e
MD5:	0EA1A08B43330AC96DF2F543C5929484
SHA1:	44FD9D5DFC05FD47FE28D0F582115E1F033BC0CA
SHA-256:	4A18159C1960282FB5850CC6146C11CF527361A9215A18CF89CCC79E556003D0
SHA-512:	9836216928F3698CB587F50C54EEB54A1AE0067E8EBEC8AC0C8E8786EACA45D28378867A12E832AE0DFB14413B15177E8DA920E90016B431AFB0C819544592F7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369418637136918","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\08582737-a4b3-4314-a04b-a130a58ab759.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46754
Entropy (8bit):	6.080399083280108
Encrypted:	false
SSDEEP:	768:dMGQ7FCYXGIgtDAWtJ4nttOFSTc+sb3kFbAP+Eby+LB5QmMDmw6n2nzvfh02tdx:dMGQ5XMBG6FgS0phEOKQm6vnzRp
MD5:	2DBD7FE95389E41B242C57AC71B7FF10
SHA1:	8B3F626B731CACD80622F022B06DA8B219116E7B
SHA-256:	8BF51F8AEBEDD88ADE956BFABC1A9E7699ADC1EF6829737D88E7AB54EB7B2DB5
SHA-512:	0ECC59A814116B6BDD18C4A4BA17FD39FEC67F04F1DFF07A802253060E1EEAF8267E77ED9FDB0444EB121FA3E4AC3A432BAD7F403E5FF6152BEC79548CE580A1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369418649944529","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\10b4bd44-e3e1-4173-baef-498eac755874.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.837256681058358
Encrypted:	false
SSDEEP:	192:fsNw4KeiRUL/1VNQ5Wy5kTa496qRAq1k8SPxVLZ7VTiB:fsNwdudVe5NKTn96q3QxVNZTiB
MD5:	DA26902CCB5569781BAB14BCEB01611D
SHA1:	B6C6BF1B8D243A20F1029A6792D86015A95CA619
SHA-256:	A7BB7E55E30C9D52D9A02278D2231A94433FC8535793ED873C911CB8E7DF59D4
SHA-512:	85E06CF5AD91B2183CE6D6444C8715331DEE2D58E7A893508D0551CBDC8AA1859044AFC83FFD7BEEE94F3052EB0F0051C497AE244A81D5DA334E5D632E26CB80
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\140d75f3-0cc3-4fc6-8a4a-a3979ac9e6cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.803025257309117
Encrypted:	false
SSDEEP:	192:fsNw4KeiRULuQtkTaF6qRAq1k8SPxVLZ7VTiQ:fsNwduv+T+6q3QxVNZTiQ
MD5:	59A556AF049234046E621A5CBC3403E3
SHA1:	7CF048B4072365CB5BA4E026D0F939259D8470E4
SHA-256:	B7910471609C14075A0A9E6A7E87DF303FF068A140141E3420331B8A045A43A8
SHA-512:	7F26CCC25D6B82AF153FF16599F710D2073256B6E162EC2368BFC1993856B080AD11A1934004BCD0622C57A1E92C9B1E9A84B99A1CF32705E8F3E58ED1BA733B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\22fe8630-069b-4db3-a063-6273a5de1951.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24685
Entropy (8bit):	6.054113877727385
Encrypted:	false
SSDEEP:	768:dMGQ7FCYXGIgtDAWtJ4n4V2nzv+h02tdx:dMGQ5XMBGbnzyp
MD5:	0DCC69E316F866551A49F5ED01BC5645
SHA1:	B8FD12249BCE5BB83DE776BFE87FAD3B8A4A9104
SHA-256:	EE836D035BF4EE6C514538AD1557520C693F57D61B89FEEAF9C7C9FB93A88FD7
SHA-512:	EE6A5D285CDF82CE790853E190B6C1107B198C8B96D51DD2E20E9BA2BA6732695D3EC947D7F1F4223194A7A6F86004F75D2CF6D227F0362AC17EF8A5AF21C44E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369418649944529","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3ca446f9-05cc-488f-a8bb-a68e7e1cf3dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46715
Entropy (8bit):	6.080508828252608
Encrypted:	false
SSDEEP:	768:dMGQ7FCYXGIgtDAWtJ4n4tOFSTc+sb3kFbAP+Eby+LB5QmMDmw6n2nzvfh02tdx:dMGQ5XMBGrFgS0phEOKQm6vnzRp
MD5:	3A4556B8B91D223F8F47C23D45740415
SHA1:	6DFB9A07863595FC3E791B4B1D048034D0754B75
SHA-256:	0F81E03FA96D2114154F5CB37AF11307558A8EFB9DB515A47AEA7EC4519449E6
SHA-512:	BD4A787C6A7D6E735F6F6CF8D9E1DD2C69D496B4A22FEBD2BDF3CB40ACA58B632FCC7746E2A34658BE01815B1C161641875E56C7F5829ECB26229CCDBBEEBD45
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369418649944529","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\58ec7488-a8e6-4298-9aac-2f2f3f7e9ffa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.059234943316333
Encrypted:	false
SSDEEP:	384:3tMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNw7uL+TV+Mh0lkdHd5q6:dMGQ7FCYXGIgtDAWtJ4nGL+Tph02tdx
MD5:	8BFAADC048F292CD1F620072287CBB6C
SHA1:	02C4A14BCAD5EF9C8035C8A418E6796C17589B7A
SHA-256:	739E4CC4852666AFCAFC7A32D9ABDB7AC75CECF000AAD2FFFFB1810C6977B677
SHA-512:	1CFF7D1D8B898F3937073D627B3B92BA90F0FABCE04F4EE65B9E1B46CE0CD3E0FF9BEEE5C80F54143F4238682775B3C06D4B9599E92D15587AA6A56501AF101B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369418649944529","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6743d8e3-d8a7-45f4-85a3-d5ce8583927a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.837184565676429
Encrypted:	false
SSDEEP:	192:fsNw4KeiRUL/1VNQ5n1mkTa496qRAq1k8SPxVLZ7VTiB:fsNwdudVe511Tn96q3QxVNZTiB
MD5:	0F1937C92F16FBC138CD4D04FACF2A5D
SHA1:	766F304A6BFE6DCE0A789D0835F5626C33DD240C
SHA-256:	97FA1F814F1A7969FEE99ADE44DF8BE99E4F67D1F99A5275E7E61BFD2636DB6D
SHA-512:	5157E85BE17B4A08D2B3B5F6471DB92696DD4D8F60181E973498C1E14743AE72C2A259E024DF3398121689803FFB19B9C4507245D13088E9856E13132F643AB8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\67703032-5a24-4a90-80fc-47118fecf349.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.837184565676429
Encrypted:	false
SSDEEP:	192:fsNw4KeiRUL/1VNQ5n1mkTa496qRAq1k8SPxVLZ7VTiB:fsNwdudVe511Tn96q3QxVNZTiB
MD5:	0F1937C92F16FBC138CD4D04FACF2A5D
SHA1:	766F304A6BFE6DCE0A789D0835F5626C33DD240C
SHA-256:	97FA1F814F1A7969FEE99ADE44DF8BE99E4F67D1F99A5275E7E61BFD2636DB6D
SHA-512:	5157E85BE17B4A08D2B3B5F6471DB92696DD4D8F60181E973498C1E14743AE72C2A259E024DF3398121689803FFB19B9C4507245D13088E9856E13132F643AB8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\93781835-3743-4177-99c3-42bc4cd3fb8c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D09299-64C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3099979551504756
Encrypted:	false
SSDEEP:	3072:S5WMUT2qzcQ3iH5t75ETEMHTt1k4nNCONxDezqJoGET/cZ94u3DqYZfTWfHLbt0t:udlS1LNCONT1mt0JaHWqy
MD5:	98D4BB30481698C541AD413A5688D1A2
SHA1:	61663FA61C8774BE863DCF64D38CE76137E13234
SHA-256:	0FA8E005CEE6A57E5F3927BCC4AB40BF5C3E0E449D23BFF793B8407B809955BB
SHA-512:	B7B28F401648C2DC430D40B722D9AB04246AC4436366972F384ADD4E15C4B54E2227CDEE8385E7D2AEA73A0EFDF0402B20818C8AE2024FC13286879CF9623863
Malicious:	false
Preview:	...@..@...@.....C.].....@................N...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".prmlrq20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D092A1-2774.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03938841484727433
Encrypted:	false
SSDEEP:	192:+3y0EbtmqvDMKXGJLMo40pNgMXMXrA0knzhfhnANfOI1gQs8Lbqq9n8y08Tcm2Rl:sy0EtA4oi4ZhA4gg4Leq08T2RGOD
MD5:	C2CD5A5BE2BFF87C2B8E32C2FC03EF09
SHA1:	BB2916AD104DBE0A05B3B5FA726E06DC6EA2F0D0
SHA-256:	C0F4892F183D5B45EE438CAF6EDC53EFE67403AF29AFDAFC3F0A072811E7DF2A
SHA-512:	9C6469A803E8C0508715AA817E2B0EF7C9B67BC311C99C3EE869194442F25A4FC474A43DD3246BC50F4CF319217770B0D682A25DEBBD42E87C7766CEE8041171
Malicious:	false
Preview:	...@..@...@.....C.].....@................_..XO..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".prmlrq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D092A9-2044.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03884033050770937
Encrypted:	false
SSDEEP:	192:nn0EbtmqvD3KX7RJEa3Xxx7UpXxgg6zfhj1NEroDtxm1gQ8887Fq2n8y08Tcm2Rl:n0EtYeZVQh53B0g48Zh08T2RGOD
MD5:	E6DD538B7A1F4AD09A9D5F20F8BD278D
SHA1:	4A34E66969100BD2291E0838F3E3D315F77926C9
SHA-256:	9E53E26FDE38E33AC0E94B8F041F537FBC3E28A12CF87E111A460126F811F583
SHA-512:	A858E55025A842FAFA9ADAB3509C83CB74B8AA36EBBCB05391AC76288B7FABF7EF6DD7374DC5C1E011C75319F74E79F416B9AB76864228DC59810789D5270F56
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".prmlrq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D092B6-26B8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03882634042658582
Encrypted:	false
SSDEEP:	192:nh0EbtmqvD3KX7ejJEa3Xxx7UpXxgg6zfh1YjNEIGtM1gQMp1ONkq2n8y08Tcm2D:h0EtdjeZVQh0LWsgN1rh08T2RGOD
MD5:	C02B18BA3AF43FA06CF4B04A95E7DDFA
SHA1:	695474558F23A6FE785C4DEA21380C6021F5354A
SHA-256:	0233BB0D72095399841ACE349F29CFE5ED0D9315D755A29A8D98A28A8A3A5717
SHA-512:	5DFEDCF01A51177D93C6BBFE387E01277F39E955FF372189777CE7ABEE70AD9210E875ABB1A81BF24A449EF90AAEB859CE50973D95F17D908B8E63DAABB14DE9
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".prmlrq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\18c0d872-9518-4d6d-a14a-ebbb2881b4a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.184025998251035
Encrypted:	false
SSDEEP:	96:sVBqlvJ1fCb9gkYlXQtVQgev/bbYNsY5Th6Cp9/x+6M8muecmAeCXRe4zvrt2X6p:sVBsJKYlA7DWTbYNsYPpj+FVAdtFBf
MD5:	5823BFA6DDCF958F9D58452ACCDE8FBA
SHA1:	6D6AAE8C8ACAF987A970B69400422C8E9D633C08
SHA-256:	1A5FBDCDE49FF16543FF408EDE503012CD337EBF0E8BE92D6CCC7B88637BB11A
SHA-512:	760CA58BCDDE35B08DA859E2EDF1B02F85C8C07630D9085AC209F8B92B5CAF47625EA601EE11533E7259C081DB0382CBAADEC7B79AAEE3E59251A6CEE3361B78
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369418649927917","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\18e371d0-13e0-47ae-92e5-303e52da673a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3aa2fdd6-320e-44ea-ae88-f37cea5d81eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.566096791279631
Encrypted:	false
SSDEEP:	768:23CIUn7pLGLvWzWP5Vfmc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVq85rA6Xrw5UppM:23CIUhcvWzWP5Vfmcu1ja/85k6E5Gte
MD5:	2DDC32CA7FFDBE3AE056BA709705749B
SHA1:	69C6260061BF0C6A1C330FEA7D08E36C2A5F934B
SHA-256:	E18E8A0FABBE5139ABCD945AF111DD1783ED127B4ADFB5DEDC19FD23DDCA689F
SHA-512:	1AB91B284F34B8610F5FDD8F1BDBAA76423CDD54D41678C874A6E8282FEE617B52AB2B413EAFDAF03B9B219BD7A9B1CAD8AD2C7E53493B0CBDEA20926B1E4BA1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369418649456916","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369418649456916","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\47571372-046d-4746-87fb-77b6f9b1fd30.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072026524091878
Encrypted:	false
SSDEEP:	96:sVBqlvJ1fCb9gkYlXQjYNsY5Th6Cp9/x+6M8muecmAeCRe4zvrt2X6gE5AtEHb:sVBsJKYlAjYNsYPpj+FVAVtFBf
MD5:	9ABF8AF92720ADCD67D96C6673E48595
SHA1:	75B31D4377F5D86F8C19CF12400AEBB924C5749A
SHA-256:	18F32E9D0004F5C973878ED8C13C586D62CED13E7164DAA22D8FB68A39A95BC7
SHA-512:	AD303860DF2F85FBC617576F044EAE789CCA0F5D4A6C1817164E0131048DF6F6449DBFAFE8622523A69650F1EB6C551E17BD86F6005873A492FC63C57359C5E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369418649927917","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.3207061748690965
Encrypted:	false
SSDEEP:	192:OAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:xOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	759F653D11A64E2C64F181AFC519E826
SHA1:	0F9C51ACCD0D7DB952B8AAB914BD99E91A297F4C
SHA-256:	5E620F716D66AED0BF0F851A4713DCCFEFC21D922BE95DD8196B2068CF3694B2
SHA-512:	9447836A50B00E32F0C21AF20F08E38CF83AA376CC8F15A8CCE0DBA4841C5F879C17AA6233BC0FD7640C32840FAF4B172352435058F60919AC3CC5A1DEB919F6
Malicious:	false
Preview:	...m.................DB_VERSION.1..:..................QUERY_TIMESTAMP:arbitration_priority_list4...13369418651951305.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.063999921534363
Encrypted:	false
SSDEEP:	6:N5kLs1wkn23oH+Tcwt9Eh1ZB2KLlL5NdF8yq2Pwkn23oH+Tcwt9Eh1tIFUv:N6LLfYeb9Eh1ZFL1jdFxvYfYeb9Eh16g
MD5:	FF5FD84DA5FC5558F20919E60EFD176D
SHA1:	08D6C1E5C2B2AE28ECEE1940BD407D967F73E7BA
SHA-256:	9019CC0865EFCAA5430FA668694A51543568593B80B96C6FA61D1F4260DA0A4B
SHA-512:	CFBADBC7E20981C31519AFF8B12B39BF991362DE6D0495B64AD7808EB9D6141D22839F29D490688B746B9466255CAB32140C81F2F4C1DE66EF1BA77980EDF35D
Malicious:	false
Preview:	2024/08/29-11:24:11.115 24c0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/29-11:24:11.228 24c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNleul:Ls3eul
MD5:	E05DCEF90402F487DE5C3273C1CCFB2F
SHA1:	C5DF2CD1CB0DB844EC735B996359D2EC4F4B1BD6
SHA-256:	BA456849F40691E48C42A72332FE122F1FCE9C9E9C55AF0466CDCE990C341C93
SHA-512:	F9D476669635C9DF89F5CFB5DED569B30A826029E0634F5278C580A834AE367F681FFF66710FBD4013416217488695F4077267C0581040F97A078657DF5789AE
Malicious:	false
Preview:	..........................................Yj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.186138790217081
Encrypted:	false
SSDEEP:	6:N5bJB1wkn23oH+TcwtnG2tbB2KLlL5QFp+q2Pwkn23oH+TcwtnG2tMsIFUv:NofYebn9VFL1+FkvYfYebn9GFUv
MD5:	3277E3D7A21B27758BCBDFA340C7D317
SHA1:	94BF87BBC74E0556F21095E942BDA87364D402C9
SHA-256:	073D2D0B956F7AB8B9421B002842E3338114FA3A2F668F47352456007732836B
SHA-512:	B745159AE3FE39C37E041865968CE4FC4A06A061B4C5F02A94EFD88CAB653F53BFBB252E247E47044B43FE66366082E645742BEFE9F3EFC379234A2B8E64689A
Malicious:	false
Preview:	2024/08/29-11:24:09.861 1e68 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/29-11:24:10.224 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.14948329940895
Encrypted:	false
SSDEEP:	6:N5/pFFB1wkn23oH+Tcwt8aVdg2KLlL5sq2Pwkn23oH+Tcwt8aPrqIFUv:NjkfYeb0L1ivYfYebL3FUv
MD5:	D93811B9CD8F3FECFD3E625D727BCC8B
SHA1:	B0BB3A8D3CFF96E71F4F5AA937B974F8F7C171C6
SHA-256:	1B807CE85BAB3500F771EA7B99AD9AB90B47F2CB0F01B75C50B1B1B231EF6D86
SHA-512:	C79D68FA920AED9F4BF7FDA9F2ED182D41B54FE696DD747AA1CDA867E5ADC49164FC8C4774127FAA36DACF21098F02F75B5539E9C49ACB665970900029F53507
Malicious:	false
Preview:	2024/08/29-11:24:09.878 1e80 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/29-11:24:09.896 1e80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.109076517750721
Encrypted:	false
SSDEEP:	6:N5JFB1wkn23oH+Tcwt86FB2KLlL5JiEq2Pwkn23oH+Tcwt865IFUv:NJkfYeb/FFL1+EvYfYeb/WFUv
MD5:	22EC1791E01CA832B45D54AAD53105C8
SHA1:	4A38959F19F410BF730938654CF508EB0B230ADE
SHA-256:	6FD0CA99CB9BA6F96D6D261A81E6D53447706336B8A7B7E6327F076F603A8003
SHA-512:	68F1F2893CC46ECBB92B7B5317F6A6560D66FD0E8E298A252306768F87A7A3C839B95984AA3527DB927136995E5EADCEF30662C1727CE727713F81B3A71889A7
Malicious:	false
Preview:	2024/08/29-11:24:09.898 1e80 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/29-11:24:09.909 1e80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.141477887134173
Encrypted:	false
SSDEEP:	6:N5J8p34q2Pwkn23oH+Tcwt8NIFUt885J8p3JZmw+85J8p3DkwOwkn23oH+Tcwt8n:NA6vYfYebpFUt88Az/+8Ap5JfYebqJ
MD5:	46297DE7B1E658365D05A3F60C616EDD
SHA1:	98C015E1080686964D038842658DD484580DE2AE
SHA-256:	02CB3C0CC6428CE9362F571BC1E9DBB4B09E7D83CDBCBAE1107BB3A382148C5C
SHA-512:	9EC70AAB6AC4B836F1D430221B2D244FEA1532274F99462B8D159EBCB9EE6CBD5558B5793A3FE31AEF0A1F818D06DB0DDCD61DB308217EE48732FE122CA3D4E4
Malicious:	false
Preview:	2024/08/29-11:24:09.974 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/29-11:24:09.974 1e40 Recovering log #3.2024/08/29-11:24:09.974 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.141477887134173
Encrypted:	false
SSDEEP:	6:N5J8p34q2Pwkn23oH+Tcwt8NIFUt885J8p3JZmw+85J8p3DkwOwkn23oH+Tcwt8n:NA6vYfYebpFUt88Az/+8Ap5JfYebqJ
MD5:	46297DE7B1E658365D05A3F60C616EDD
SHA1:	98C015E1080686964D038842658DD484580DE2AE
SHA-256:	02CB3C0CC6428CE9362F571BC1E9DBB4B09E7D83CDBCBAE1107BB3A382148C5C
SHA-512:	9EC70AAB6AC4B836F1D430221B2D244FEA1532274F99462B8D159EBCB9EE6CBD5558B5793A3FE31AEF0A1F818D06DB0DDCD61DB308217EE48732FE122CA3D4E4
Malicious:	false
Preview:	2024/08/29-11:24:09.974 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/29-11:24:09.974 1e40 Recovering log #3.2024/08/29-11:24:09.974 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3274880553126037
Encrypted:	false
SSDEEP:	6:uaA/J3+t76Y4QZZofU99pO0BYPSqR4EZY4QZvGQ:uLhHQws9LdOZBQZGQ
MD5:	AA8811B49A1A9E3AA3D44AFBBB5B5D83
SHA1:	810B603432F4BDE4DE3F3C30D177B2686413FC51
SHA-256:	2ED47DF4C2722F551DD6FA1A7C279CCC09AFF19B0658FB75A026887B443036DC
SHA-512:	28494B754F668D6C81838E5E3533988BC51C08C641CB05587340D771716F174053481FEE1FDA5DCF436882AF558DE3AD7F8A46F710080C73F3F501C4862B752B
Malicious:	false
Preview:	............%.Na...'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.242847128003306
Encrypted:	false
SSDEEP:	12:N+FvYfYeb8rcHEZrELFUt88+Q/+8+Y5JfYeb8rcHEZrEZSJ:N+JYfYeb8nZrExg88+e+CJfYeb8nZrE8
MD5:	AC01598BABDFEC7FD2893E1A645D8850
SHA1:	350D6691AC5AE2A887A538124B659DBE1A5C1C6B
SHA-256:	BC8B9AF195B5B08949C47A20EE16A7065B1404CF069A3612AA86440D2BB60024
SHA-512:	3F40DE3146927BFA1914F841481B5E03489D2E9A5FB510B530A24DFFB20DC73B69546FD74D700B2815E7DE798E7BEA5F229D4B06E40E202B2F17DBE0A9D70D79
Malicious:	false
Preview:	2024/08/29-11:24:10.984 1de8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/29-11:24:10.984 1de8 Recovering log #3.2024/08/29-11:24:10.984 1de8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.242847128003306
Encrypted:	false
SSDEEP:	12:N+FvYfYeb8rcHEZrELFUt88+Q/+8+Y5JfYeb8rcHEZrEZSJ:N+JYfYeb8nZrExg88+e+CJfYeb8nZrE8
MD5:	AC01598BABDFEC7FD2893E1A645D8850
SHA1:	350D6691AC5AE2A887A538124B659DBE1A5C1C6B
SHA-256:	BC8B9AF195B5B08949C47A20EE16A7065B1404CF069A3612AA86440D2BB60024
SHA-512:	3F40DE3146927BFA1914F841481B5E03489D2E9A5FB510B530A24DFFB20DC73B69546FD74D700B2815E7DE798E7BEA5F229D4B06E40E202B2F17DBE0A9D70D79
Malicious:	false
Preview:	2024/08/29-11:24:10.984 1de8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/29-11:24:10.984 1de8 Recovering log #3.2024/08/29-11:24:10.984 1de8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.170830827430588
Encrypted:	false
SSDEEP:	6:N5QJq2Pwkn23oH+Tcwt8a2jMGIFUt885QlzZmw+85Q07kwOwkn23oH+Tcwt8a2jz:N+JvYfYeb8EFUt88+lz/+8+075JfYebw
MD5:	455C82E6978835254EA14F2158CE0CC0
SHA1:	8D4B8B4D41F3A60CCCB66B9FD8EBAF587A0E2157
SHA-256:	71AC9F8131DA8F8F50C3BEE4F4682A4B8C36389DF5E1A549B39976CA645FB8F8
SHA-512:	B7114DB68A0DF09ED5BF3FFACD8C6BD2FD9C2F302406AB9B770E33609B59D529708DE292DEC17E7AC64AEE36D314209DFFAE97DDECB8A6E04B89206E626FAC0D
Malicious:	false
Preview:	2024/08/29-11:24:10.775 cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/29-11:24:10.778 cc0 Recovering log #3.2024/08/29-11:24:10.887 cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.170830827430588
Encrypted:	false
SSDEEP:	6:N5QJq2Pwkn23oH+Tcwt8a2jMGIFUt885QlzZmw+85Q07kwOwkn23oH+Tcwt8a2jz:N+JvYfYeb8EFUt88+lz/+8+075JfYebw
MD5:	455C82E6978835254EA14F2158CE0CC0
SHA1:	8D4B8B4D41F3A60CCCB66B9FD8EBAF587A0E2157
SHA-256:	71AC9F8131DA8F8F50C3BEE4F4682A4B8C36389DF5E1A549B39976CA645FB8F8
SHA-512:	B7114DB68A0DF09ED5BF3FFACD8C6BD2FD9C2F302406AB9B770E33609B59D529708DE292DEC17E7AC64AEE36D314209DFFAE97DDECB8A6E04B89206E626FAC0D
Malicious:	false
Preview:	2024/08/29-11:24:10.775 cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/29-11:24:10.778 cc0 Recovering log #3.2024/08/29-11:24:10.887 cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\16214a8e-c45e-4a95-a08d-8a90b69c44b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.301036275992925
Encrypted:	false
SSDEEP:	24:YXsPGZVMdBsPcZFRudFGcsPqsZFGJ/dbG7nby:YXsPS8sPEfcdsPqUgzbZ
MD5:	4AED4D40C714F210DC45D0CA95CE0997
SHA1:	BCBDFD34305E56D6AE02809BD7A5F70DEF14CF90
SHA-256:	3C993281B3622DB2396338C04510F559BD5766292AA94B968C3539F1B4FCFB9F
SHA-512:	02B4C01FD7CB89A4615C910A978F3103841D9FFD7236ED058C9FB04CBE84A5C4CFC1728F3A6AA391A069DCECC3DFB10A5AB2B5A09D0DFCB6D0ADE17DB563AFCE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372010651992593","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372010653154425","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372010656102163","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3fbbccab-5a37-4fef-ac5c-51e412df970d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5561d151-09eb-4357-896a-c243b5d61dab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5c5ca349-6227-470f-a409-5b5dbde941c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8efd1abd-5884-4d4c-b8aa-ca61c97ca5fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2e8ef.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3d6c9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2c23c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d111.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2e8df.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca0ecda0-4f48-45fc-b50f-40eab89e6d4e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\db51b6c7-b74e-4568-ab07-3542847037bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072026524091878
Encrypted:	false
SSDEEP:	96:sVBqlvJ1fCb9gkYlXQjYNsY5Th6Cp9/x+6M8muecmAeCRe4zvrt2X6gE5AtEHb:sVBsJKYlAjYNsYPpj+FVAVtFBf
MD5:	9ABF8AF92720ADCD67D96C6673E48595
SHA1:	75B31D4377F5D86F8C19CF12400AEBB924C5749A
SHA-256:	18F32E9D0004F5C973878ED8C13C586D62CED13E7164DAA22D8FB68A39A95BC7
SHA-512:	AD303860DF2F85FBC617576F044EAE789CCA0F5D4A6C1817164E0131048DF6F6449DBFAFE8622523A69650F1EB6C551E17BD86F6005873A492FC63C57359C5E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369418649927917","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF33f4c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072026524091878
Encrypted:	false
SSDEEP:	96:sVBqlvJ1fCb9gkYlXQjYNsY5Th6Cp9/x+6M8muecmAeCRe4zvrt2X6gE5AtEHb:sVBsJKYlAjYNsYPpj+FVAVtFBf
MD5:	9ABF8AF92720ADCD67D96C6673E48595
SHA1:	75B31D4377F5D86F8C19CF12400AEBB924C5749A
SHA-256:	18F32E9D0004F5C973878ED8C13C586D62CED13E7164DAA22D8FB68A39A95BC7
SHA-512:	AD303860DF2F85FBC617576F044EAE789CCA0F5D4A6C1817164E0131048DF6F6449DBFAFE8622523A69650F1EB6C551E17BD86F6005873A492FC63C57359C5E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369418649927917","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ccc7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072026524091878
Encrypted:	false
SSDEEP:	96:sVBqlvJ1fCb9gkYlXQjYNsY5Th6Cp9/x+6M8muecmAeCRe4zvrt2X6gE5AtEHb:sVBsJKYlAjYNsYPpj+FVAVtFBf
MD5:	9ABF8AF92720ADCD67D96C6673E48595
SHA1:	75B31D4377F5D86F8C19CF12400AEBB924C5749A
SHA-256:	18F32E9D0004F5C973878ED8C13C586D62CED13E7164DAA22D8FB68A39A95BC7
SHA-512:	AD303860DF2F85FBC617576F044EAE789CCA0F5D4A6C1817164E0131048DF6F6449DBFAFE8622523A69650F1EB6C551E17BD86F6005873A492FC63C57359C5E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369418649927917","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558004285344771
Encrypted:	false
SSDEEP:	768:23CIUn7pLGLvWzWP5VfBc8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+rA6Xrw5apptul:23CIUhcvWzWP5VfBcu1ja7k6E50tu
MD5:	38D4959AD6D6C5089AE451108038103D
SHA1:	ACF146CF986203CD4C6090215F4C5DA0C60464F5
SHA-256:	BB65A97654E4D63A55CB948C22956D128139069548744C482E743CA4D458B36A
SHA-512:	CBB89A76DD24C38C9A096F8F794AF7B80B55C57A93775CF0428C7047D5BB50150DFEFF97957AA701573A74A2EE229EF422B058FF4972A121BAEE834969E79C33
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369418649456916","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369418649456916","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF32339.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558004285344771
Encrypted:	false
SSDEEP:	768:23CIUn7pLGLvWzWP5VfBc8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+rA6Xrw5apptul:23CIUhcvWzWP5VfBcu1ja7k6E50tu
MD5:	38D4959AD6D6C5089AE451108038103D
SHA1:	ACF146CF986203CD4C6090215F4C5DA0C60464F5
SHA-256:	BB65A97654E4D63A55CB948C22956D128139069548744C482E743CA4D458B36A
SHA-512:	CBB89A76DD24C38C9A096F8F794AF7B80B55C57A93775CF0428C7047D5BB50150DFEFF97957AA701573A74A2EE229EF422B058FF4972A121BAEE834969E79C33
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369418649456916","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369418649456916","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.147734193467945
Encrypted:	false
SSDEEP:	6:N5gOq2Pwkn23oH+TcwtrQMxIFUt885MGvJZmw+85SFkwOwkn23oH+TcwtrQMFLJ:N7vYfYebCFUt88eGh/+8o5JfYebtJ
MD5:	BB1C2ECF0EBE918472A1163E6EB76693
SHA1:	ADB1F60E620D25890144A0AF32E05DB1734FBDE8
SHA-256:	CB0D4E7C0798D86D4D9F4B59B1F8B5F147A72DEA7D6C4AF544C7C1AD2E8C15E6
SHA-512:	8B3808911C2FC84A76AF160234917F00718B176C067C271E4CFD223F737A34AC03ABAD2D64F93EB8D57E25EF47B32CB75BF1704EFAB4605E6FFEBC9F3C5DEA32
Malicious:	false
Preview:	2024/08/29-11:24:25.941 cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/29-11:24:25.944 cc0 Recovering log #3.2024/08/29-11:24:25.947 cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.147734193467945
Encrypted:	false
SSDEEP:	6:N5gOq2Pwkn23oH+TcwtrQMxIFUt885MGvJZmw+85SFkwOwkn23oH+TcwtrQMFLJ:N7vYfYebCFUt88eGh/+8o5JfYebtJ
MD5:	BB1C2ECF0EBE918472A1163E6EB76693
SHA1:	ADB1F60E620D25890144A0AF32E05DB1734FBDE8
SHA-256:	CB0D4E7C0798D86D4D9F4B59B1F8B5F147A72DEA7D6C4AF544C7C1AD2E8C15E6
SHA-512:	8B3808911C2FC84A76AF160234917F00718B176C067C271E4CFD223F737A34AC03ABAD2D64F93EB8D57E25EF47B32CB75BF1704EFAB4605E6FFEBC9F3C5DEA32
Malicious:	false
Preview:	2024/08/29-11:24:25.941 cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/29-11:24:25.944 cc0 Recovering log #3.2024/08/29-11:24:25.947 cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.150732012178339
Encrypted:	false
SSDEEP:	6:N5FuOq2Pwkn23oH+Tcwt7Uh2ghZIFUt885FVgZZmw+85FVgzkwOwkn23oH+Tcwts:NuOvYfYebIhHh2FUt88VgZ/+8Vgz5Jf0
MD5:	1C6D6892EB0C5DC33B833CB8EC63B13E
SHA1:	5883A7DCB3CEFF71CAD5C295FEA099325D90C1A4
SHA-256:	B0683C09D0DF0C462223AC195CF412EDBCE8C89E8375E0759585837670149874
SHA-512:	73DC7C0105E0950B59F2D9A2C88423DF6E3F7A913E3B61C4E6D318046E9D49468446C2A9B43F878E3D2468AB8514306882E3FDC596B67238E5AFA7BC6B571E22
Malicious:	false
Preview:	2024/08/29-11:24:09.559 1e50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/29-11:24:09.560 1e50 Recovering log #3.2024/08/29-11:24:09.560 1e50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.150732012178339
Encrypted:	false
SSDEEP:	6:N5FuOq2Pwkn23oH+Tcwt7Uh2ghZIFUt885FVgZZmw+85FVgzkwOwkn23oH+Tcwts:NuOvYfYebIhHh2FUt88VgZ/+8Vgz5Jf0
MD5:	1C6D6892EB0C5DC33B833CB8EC63B13E
SHA1:	5883A7DCB3CEFF71CAD5C295FEA099325D90C1A4
SHA-256:	B0683C09D0DF0C462223AC195CF412EDBCE8C89E8375E0759585837670149874
SHA-512:	73DC7C0105E0950B59F2D9A2C88423DF6E3F7A913E3B61C4E6D318046E9D49468446C2A9B43F878E3D2468AB8514306882E3FDC596B67238E5AFA7BC6B571E22
Malicious:	false
Preview:	2024/08/29-11:24:09.559 1e50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/29-11:24:09.560 1e50 Recovering log #3.2024/08/29-11:24:09.560 1e50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulLaKllll:Lsvul
MD5:	0C7F51158D73CEDFF7B599375A2EA4B0
SHA1:	2561ADF083FF7128BF3FA3066E0A434AA7D3843E
SHA-256:	AF0F01224CA641946EB56A27D72C1EA35F5D5499242A927E18FFA8B60896B3ED
SHA-512:	31470261BD036A9FE7FDF814529F6945B08AB846CB49A760664ED6765245A70570F721E383204FC486B6225D30B79BF5DF7FDE4A13514366473DCAFFB671636F
Malicious:	false
Preview:	.........................................M.Yj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlNeLl:Ls3Wl
MD5:	E4EFB994246CEF3C69BE2729688251D7
SHA1:	BDF7BB9914B51F717D5333DD5E173654737BF909
SHA-256:	D72FC2F131564B8E624680075A69C6100115A08A5B6A3E8844F9B90761B17B69
SHA-512:	C12883C33F882B2DDE4CA663B4833181B751C9D8F85E7B6DB02DA75F65B44751B0ADA8CEAE5AEFB931D91CF7011D88CCD75035C5533AB24185C58440A31AAD1B
Malicious:	false
Preview:	........................................>.Yj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.244029363471123
Encrypted:	false
SSDEEP:	12:N+xvYfYebvqBQFUt88+yC1/+8+yc5JfYebvqBvJ:N+9YfYebvZg88+yi+yGJfYebvk
MD5:	8DB575718F721EA31BDD4FD16F406F1A
SHA1:	7DFBF22181F5815E54831138EC9F21D3590926EE
SHA-256:	67124226FCE7EFC1CA07F420BE868BA89A8E316EF323ED927458610F3E755E58
SHA-512:	C6F8651A40AA09A951E74F932E37A5EDB1F77FFD3AB76AA257B67CE8ED0101DBB78ADCB62A9DD493D7C96B7DC216D8A5D6E716752A0EEBE536EAEB84872234D4
Malicious:	false
Preview:	2024/08/29-11:24:10.783 2430 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/29-11:24:10.890 2430 Recovering log #3.2024/08/29-11:24:10.898 2430 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.244029363471123
Encrypted:	false
SSDEEP:	12:N+xvYfYebvqBQFUt88+yC1/+8+yc5JfYebvqBvJ:N+9YfYebvZg88+yi+yGJfYebvk
MD5:	8DB575718F721EA31BDD4FD16F406F1A
SHA1:	7DFBF22181F5815E54831138EC9F21D3590926EE
SHA-256:	67124226FCE7EFC1CA07F420BE868BA89A8E316EF323ED927458610F3E755E58
SHA-512:	C6F8651A40AA09A951E74F932E37A5EDB1F77FFD3AB76AA257B67CE8ED0101DBB78ADCB62A9DD493D7C96B7DC216D8A5D6E716752A0EEBE536EAEB84872234D4
Malicious:	false
Preview:	2024/08/29-11:24:10.783 2430 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/29-11:24:10.890 2430 Recovering log #3.2024/08/29-11:24:10.898 2430 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8ae325d3-2537-472c-9c6e-4769aa103602.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8b95a0bc-505f-4a25-8ffd-738f05ae9ca4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3e763.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2d111.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cf770823-77c4-4265-b0d0-5ed1f1ca4f75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ebf2df62-6fe9-4e52-b473-c38804970a25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.228423532870357
Encrypted:	false
SSDEEP:	12:NtvYfYebvqBZFUt88qi/+8Ur5JfYebvqBaJ:NxYfYebvyg88tU9JfYebvL
MD5:	D46DC3703C60A4E8C0F597196FA77F2C
SHA1:	06770A47D2858E60625F2FE1F053361A505BD3F7
SHA-256:	1B19CC326EB4084379508255DF076A5E94E73C8C0BD4F9B524C85773F82C4D8D
SHA-512:	5E387C998E870F352F741CC77CFE0B3ADC83CC374ACE79A05C1AC294750DE55EE37AAD08C4B2E065B16AC3902B8B10C01DA3E03CA65A84B57D8C64A54EA11D48
Malicious:	false
Preview:	2024/08/29-11:24:26.027 cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/29-11:24:26.028 cc0 Recovering log #3.2024/08/29-11:24:26.032 cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.228423532870357
Encrypted:	false
SSDEEP:	12:NtvYfYebvqBZFUt88qi/+8Ur5JfYebvqBaJ:NxYfYebvyg88tU9JfYebvL
MD5:	D46DC3703C60A4E8C0F597196FA77F2C
SHA1:	06770A47D2858E60625F2FE1F053361A505BD3F7
SHA-256:	1B19CC326EB4084379508255DF076A5E94E73C8C0BD4F9B524C85773F82C4D8D
SHA-512:	5E387C998E870F352F741CC77CFE0B3ADC83CC374ACE79A05C1AC294750DE55EE37AAD08C4B2E065B16AC3902B8B10C01DA3E03CA65A84B57D8C64A54EA11D48
Malicious:	false
Preview:	2024/08/29-11:24:26.027 cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/29-11:24:26.028 cc0 Recovering log #3.2024/08/29-11:24:26.032 cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.21403507316431
Encrypted:	false
SSDEEP:	6:N5FSSQ+q2Pwkn23oH+TcwtpIFUt885FSSgZmw+85FKPzQVkwOwkn23oH+Tcwta/o:NSSQ+vYfYebmFUt88SSg/+8WQV5JfYev
MD5:	30CAAF2E1827B22086098DFD5F81C766
SHA1:	72123E12784F02FF8254B0D15951AF6548F7C128
SHA-256:	AC3D87AAF17FF33A284263D1A243AC093FC182EC39EB332F4B5BE43DF935DB4B
SHA-512:	1ACB986B829825D912644940B407E3FFFFEDBC3346C7780473BDCB9F60B6094AA0CB95B216B4766A49E93ED2154D6F62A2CDB0392F5C7E947EF5B5050B88D914
Malicious:	false
Preview:	2024/08/29-11:24:09.515 1e4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/29-11:24:09.515 1e4c Recovering log #3.2024/08/29-11:24:09.516 1e4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.21403507316431
Encrypted:	false
SSDEEP:	6:N5FSSQ+q2Pwkn23oH+TcwtpIFUt885FSSgZmw+85FKPzQVkwOwkn23oH+Tcwta/o:NSSQ+vYfYebmFUt88SSg/+8WQV5JfYev
MD5:	30CAAF2E1827B22086098DFD5F81C766
SHA1:	72123E12784F02FF8254B0D15951AF6548F7C128
SHA-256:	AC3D87AAF17FF33A284263D1A243AC093FC182EC39EB332F4B5BE43DF935DB4B
SHA-512:	1ACB986B829825D912644940B407E3FFFFEDBC3346C7780473BDCB9F60B6094AA0CB95B216B4766A49E93ED2154D6F62A2CDB0392F5C7E947EF5B5050B88D914
Malicious:	false
Preview:	2024/08/29-11:24:09.515 1e4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/29-11:24:09.515 1e4c Recovering log #3.2024/08/29-11:24:09.516 1e4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:vClyHl1lhtlVy:+yH3g
MD5:	82017E5E9035BD5FE3745CEF82B59B69
SHA1:	654333E47640D967CFC4FCFED533F6C96795BA45
SHA-256:	ACAE312903DE9C2FBB49F952D6E51326F871204F9CA7DEC62150758EF46CFF5F
SHA-512:	161E428C20755D3700DBFF3F76FC8BC44347C1974AFAA911666B63C761D2D04546E78F7B4E182CF0B6FBD387906A2FBC9FDB13C46F56FE7524B28C87D45CEA60
Malicious:	false
Preview:	...................W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b9dc7058-f57b-415a-b22a-1e4f20ed755c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c6866ffa-7ba8-47f4-b200-b3effd60f3dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558004285344771
Encrypted:	false
SSDEEP:	768:23CIUn7pLGLvWzWP5VfBc8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+rA6Xrw5apptul:23CIUhcvWzWP5VfBcu1ja7k6E50tu
MD5:	38D4959AD6D6C5089AE451108038103D
SHA1:	ACF146CF986203CD4C6090215F4C5DA0C60464F5
SHA-256:	BB65A97654E4D63A55CB948C22956D128139069548744C482E743CA4D458B36A
SHA-512:	CBB89A76DD24C38C9A096F8F794AF7B80B55C57A93775CF0428C7047D5BB50150DFEFF97957AA701573A74A2EE229EF422B058FF4972A121BAEE834969E79C33
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369418649456916","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369418649456916","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d36eecb8-1c14-47ea-b667-f153d7cc44d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9333
Entropy (8bit):	5.182628451048301
Encrypted:	false
SSDEEP:	96:sVBqlvJ1fCb9gkYlXQtVQgev/bbYNsY5Th6Cp9/x+6M8muecmAeCORe4zvrt2X6p:sVBsJKYlA7DWTbYNsYPpj+FVAYtFBf
MD5:	17C5CE6CF8D471CF5E1110DA8DC398FE
SHA1:	FF15FFC9C9BC5530D7C4F0A2E8CAB86381199BCB
SHA-256:	68326AD4566FD92A1994E2219E548B41FEB7F13B5C16CD204C3405C97F010AF6
SHA-512:	24BCA3F3B43D4AC746BA3EDCE1F9C3BC42197608C1A8BC6FC3AC7FF03C447AA245D51F97F47C9CFFE3626ED84FCEDB04D5C431F33521EF61E765A6A1EF1A312D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369418649927917","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	124
Entropy (8bit):	4.322561786708246
Encrypted:	false
SSDEEP:	3:VVXntjQCrplkQSeseGKT9rcQ6xjCzMJl:/Xnt//3sedhO+cl
MD5:	53074370145588238862938841065FD8
SHA1:	883D2EF27107F7064D121BFA3B06E2E83D468748
SHA-256:	5EA493101BA724BB24A09E07C07FB943E8FAC6112F37C3D520B439CA617F6BF5
SHA-512:	E477858B48DD43A531DC9EA881E8972BD69B72EAAA406EB9DFA97F61E07A6AD81510EB4DE275C7F53F63A3D4FA359505007A0496B16C7053AD50BCEA6C38B4E7
Malicious:	false
Preview:	A..r.................20_1_1...1..F....................0................39_config..........6.....n ...1..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.206879676041552
Encrypted:	false
SSDEEP:	6:N5J+z0q1wkn23oH+Tcwtfrl2KLlL5JQX34q2Pwkn23oH+TcwtfrK+IFUv:N6A1fYeb1L1UXIvYfYeb23FUv
MD5:	C05462954E807D3183EAA29AD40334B1
SHA1:	DDF7AD5F8DB0EECAD42CED46F5928F730B03FF98
SHA-256:	C2253119666F4F8A0598F2E246953D34891C6C6EB4827625A6D59DDC26E1EFCD
SHA-512:	6091BECA1E836D8023E5BC183DF075293968CCC91047FA0F2EE142AF058D3A351938980645943180C82DED6A48AF6505C1A8218EB511CC24F55357E4DD03F3D8
Malicious:	false
Preview:	2024/08/29-11:24:09.958 1e40 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/29-11:24:09.969 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	646
Entropy (8bit):	3.9271230991270314
Encrypted:	false
SSDEEP:	12:G0nYUtTNVdZ5zD/7bEXZmh/U/9Y+chR6XuHDaZg+ra:G0nYUtP35zDjomhCe+cieHDEgZ
MD5:	174F96A54CDB7709271699D44924E945
SHA1:	8F1DE8423E4F58CD28DC07C050CA131CD74307DB
SHA-256:	4FB7FE2A698A38A5729F8FDB2B69F0A2D5AC3546D6453FE30EDC4B24DA16A7FF
SHA-512:	1A4F1AB335C59629F884F1326E06304FF023C44E95772C0AD4254E4B9BE481465847B852254A795B079998D957AB85818E4827D0719A0543F72C50846E2CF0E8
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....'...................20_.......T=.................19_.....*...................18_........a.................37_......x...................38_........i.................39_.........................20_........].................20_.....{a...................19_.....f.F..................18_.......\|.................37_.......&B.................38_........D.................39_........................21_......Gt&.................21_.....p.j..................9_.....JJ...................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.171083801497766
Encrypted:	false
SSDEEP:	6:N5Jaq1wkn23oH+Tcwtfrzs52KLlL5JF+4q2Pwkn23oH+TcwtfrzAdIFUv:NG1fYebs9L15dvYfYeb9FUv
MD5:	17250C0D6A8A7EF9FFB9E4FA7B4DCE87
SHA1:	A540C034E706ABA79E0A51177A407C83B9F454B0
SHA-256:	990F833A1AC8CD1DC20472ADEC0587B19FD3E13641E46CEECA87075968349C6D
SHA-512:	8950457AFA9297E4BE34A2A9CB11254548AAD71B9EA1E519F273EA27C08B1935FA52DCB5F0636AC6B7D48CE21F715AAA2A06E3D8426CEF7FF52ED20155295B2E
Malicious:	false
Preview:	2024/08/29-11:24:09.933 1e40 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/29-11:24:09.947 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlk8i+/l:Ls3d/l
MD5:	562471628B2DB2BA8447E2FE385E6B11
SHA1:	241F31C7DF352C074F550B2C8280266A72DFE7AE
SHA-256:	26F6D357667D5288FE70E778C17FCF8FA440FD9E2B60BEEA3B246ECDC42E7AAA
SHA-512:	D1010382B4FDF38BED27205639F4D416F7FDDE9ECD564891F9A02EEEFB484887BFA46DFEFC3EA3A4519FEEA676B174A10094432AA60379DDFB5D7EFA60646E9B
Malicious:	false
Preview:	..........................................Yj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlmLl:Ls3ol
MD5:	6B5DDA47B79C2AD7F2F353661E76E503
SHA1:	9420835522001CA0D7AFC15B2B68768E17B6C761
SHA-256:	375614B9997DEF9BA4B7526BCE39842379FE9720A707B9CD2B27B568DA9C2AFB
SHA-512:	4995E04634FB240DE985A7296B8DEF690236F16FB9E9251E12B72D8AC6EFA6F77B7581F74130E7B1DBF7280CE02A2670C652FE772681A27F73EADCCF94B963AE
Malicious:	false
Preview:	........................................._.Yj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2bd5a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2bd6a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2dbdf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2dc2d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2dc6c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2dc7b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2fcd4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF32f8d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a598.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ccb7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41d19.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl6l:Ls36l
MD5:	9E04A45E08FD3B87C2DF21F56BFA7D0F
SHA1:	CAA89F55246ADF2CFB220CF7EDE1398573EFDC08
SHA-256:	46DBF73FF0DFFEA4EC3E66CA0900524A553843D81025A999E444352646BCD7AB
SHA-512:	7CDBF2E71C463E14D9C5363C1470A26877F9B205F6D676EC8510BCF3EBC10552AE39B21884E9DCFC3CBD7B095370C2F13F8BC8E19BD33191F24D669DEB373F15
Malicious:	false
Preview:	..........................................uYj./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b9e5f069-e39a-45c6-85c7-340dfc503ed8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.80927509271992
Encrypted:	false
SSDEEP:	192:fsNA4KeiRUouQtkTaF6qRAq1k8SPxVLZ7VTiQ:fsNAdHv+T+6q3QxVNZTiQ
MD5:	178DF24832232FB02B331353A6D4F265
SHA1:	6F72C6C95B7E252D031EC8A7170F93AB7088F1A0
SHA-256:	F510ECFAFD358986ADB88E533415765DE687F5A1CB54C8041AA86A2DBC5F5429
SHA-512:	8F95FED4558F0CBFE47455171868E464DBFA311AB59C1D5FA1BE2353F630C9A568DF916DCEFAC35B2F6506BE4ADF452A933AD8FED721998B27AAA26296FDE956
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dbb74855-6095-45e2-977a-d6c9eb469067.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.837256681058358
Encrypted:	false
SSDEEP:	192:fsNw4KeiRUL/1VNQ5Wy5kTa496qRAq1k8SPxVLZ7VTiB:fsNwdudVe5NKTn96q3QxVNZTiB
MD5:	DA26902CCB5569781BAB14BCEB01611D
SHA1:	B6C6BF1B8D243A20F1029A6792D86015A95CA619
SHA-256:	A7BB7E55E30C9D52D9A02278D2231A94433FC8535793ED873C911CB8E7DF59D4
SHA-512:	85E06CF5AD91B2183CE6D6444C8715331DEE2D58E7A893508D0551CBDC8AA1859044AFC83FFD7BEEE94F3052EB0F0051C497AE244A81D5DA334E5D632E26CB80
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fe03cf62-630d-4000-8876-d4cce6710eff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7963108729205075
Encrypted:	false
SSDEEP:	96:iaqkHfw3P+5ih/cI9URLl8RotoeMFVvlwhEe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4XeiRUJhU6qRAq1k8SPxVLZ7VTiq
MD5:	F13BF9EFF2200F34F74978CCCAB0E6B1
SHA1:	B167AD79B1B09767288AB74F0049F68FC2ED5D14
SHA-256:	8A2091D9C9595C00F9C6B53539376D88A56C25D11FA4E74D19B6C51BD84D52E3
SHA-512:	4BE7706A96A6F1FF910515962E8C35F88A2F83074EB298736310F3AB0BA5B52863C0715F079C1585F85078373531A2F22D81A9A07EFCBF387696503E7845C87D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACYFf+V4NPcQrP8tY/LQe4eEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC2GNAbP0undcyE45UNNApThCxVyGiPj2hwNjKuF1gE7QAAAAA

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8557875317291685
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx2Ixl9Il8u6buyx6z7e+8n3LYH5NuneMLJQmd1rc:miY0uyMZ83LYHUeIJQd
MD5:	0BD8E2B719A4EDC41FCBF0F7DFD59251
SHA1:	052142BBDDDEFB10606CFA9B9B9E655D57B49D1C
SHA-256:	3B815D25BB7930F018B8B3D3C06CBF0AC018C1CF7512D32756109CBE3CD703CB
SHA-512:	A1FE4A01375AF84B4EDC42AA5960CB2A4BB204540198F1167714FCFE4C7E668D0E71FB3EBC88663E8244B17097E1288E038EA41E3286E9E40FFC792CBE36F686
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.G.N.7.2.S./.6.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.B.X./.l.e.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.005585113638058
Encrypted:	false
SSDEEP:	48:uiTrlKxExsxD9Il8uoPL0SYNaW2jml3hP2a4Hrmj8w1ioL6Is1bPATFlyGQmBiQL:mYu0vRvhORLaF6Ik8uGQ0is
MD5:	B86B2E00B98D8F58CF298766BC7BC73F
SHA1:	A2B7BEBCA818CE4153DD27880CB88E82BF99B310
SHA-256:	6EF38530CF0A91C99681D128763997FD69BD8BF9B80FA6897FED5A770D9AC3BC
SHA-512:	A8852D1FCE7CCF5B4EB85470FFD8EA9C34A076324AD3F11E24112E9DCA8F9A68403229A79CFD6316EEA382CCF11C884F8FA1F5BCF7C9D02FDBF16F520231D104
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".M./.G.h.v.y.f.6.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.B.X./.l.e.

C:\Users\user\AppData\Local\Temp\377de67c-fa20-4ba3-b70f-b3bae4fd2c3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\45a58b87-119a-460a-b62b-036ab1fd9b01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\5f1b1006-d0fc-410d-a45b-f27bc8e3e446.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\960bba73-32c7-4c5e-872e-2917259273a0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.33951104283672
Encrypted:	false
SSDEEP:	12:YQx67I0Dkv/QrE56s/QPwLx0Dkv/DJLB156s/C:YQx90ZrE5ae08B15M
MD5:	5F00010E73F0246B6808B6AD5B0E541F
SHA1:	E1F01F3AA6CBDFDF4F01D189039F755405977D2C
SHA-256:	D4B358CCAD2B38145AB103676F27A2AE825EC033091B466AF64774CF39F43ADC
SHA-512:	DB2C6E3DDFDBC208CC251E0CC12C9DB32DE4E74CADEB5287B524629C2FE988D64044E70CD4D310CC465BA2E247CCD35E8E1F6569EF3D5D83496F9B9A0B52514A
Malicious:	false
Preview:	{"logTime": "0829/152400", "correlationVector":"59F57733EBEA4B9AAE04688B5140E286","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0829/152411", "correlationVector":"emf9E9sEqcyFPc0UxWEJOg","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0829/152411", "correlationVector":"63868355E4524546BA84757A85B41631","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0829/152412", "correlationVector":"s12wh6zBt+PqlbI3Jzl4Uo","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\scoped_dir1612_10612136\45a58b87-119a-460a-b62b-036ab1fd9b01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir1612_10612136\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir1612_10612136\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1612_10612136\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1612_10612136\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\377de67c-fa20-4ba3-b70f-b3bae4fd2c3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir1612_2005976819\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.522035774403191
Encrypted:	false
SSDEEP:	48:MEt72dOwuKMsJ8/rlzBdLXuHkkDpG2AZidOwjGKMsJ8/rlzngdLXuHkk+21:Dv3uEkDN1gnIuEkz
MD5:	0A4659C907B1FB73DD67911955091F8F
SHA1:	976D13836566641689024F1A0B481F8169BE0D18
SHA-256:	B3CDC530CE8EA6EDE0D25E01BFBF59FE9AF78A939652E4C129A0D8E1346984F2
SHA-512:	96FDA401C522A135BEC6273B8FCB126FC5CD5D92080965A7B55D8194BB909BCCB69DF051D05F553B4C512723ADECA4400C63EE4DCA7836E36ACE66DBB2EDE276
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....\.x'....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V......}V.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y.z..........................H..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.z..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.z....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j.............6......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I2W3EDTNKVKK8WRH605W.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5167634358652484
Encrypted:	false
SSDEEP:	48:MEZidOwjGKMsJ8/rlzBdLXuHkkDpG2AZidOwjGKMsJ8/rlzngdLXuHkk+21:Cg3uEkDN1gnIuEkz
MD5:	8572664ECC2A246FDC083DBBD6E855D7
SHA1:	8EDCD1511DDAC9152ACB73320491F03A32AD693E
SHA-256:	297572ECC7780EB901D532E3A7E6A6BD281476B31C1444D49A07B6EC4621716C
SHA-512:	8B0E5833D93BE36600E7932BC23D271A3A078AB3059410A62C31930BE58035F1F1C594042AF054C5D1745C0F356B9F32E16C02976330EFF2A3C64D7D66B8E368
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....\.x'....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y.z..PROGRA~2.........O.I.Y.z....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y.z..........................H..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y.{...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.z..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.z....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j.............6......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TD6D870HVZHXXXW5M530.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.522035774403191
Encrypted:	false
SSDEEP:	48:MEt72dOwuKMsJ8/rlzBdLXuHkkDpG2AZidOwjGKMsJ8/rlzngdLXuHkk+21:Dv3uEkDN1gnIuEkz
MD5:	0A4659C907B1FB73DD67911955091F8F
SHA1:	976D13836566641689024F1A0B481F8169BE0D18
SHA-256:	B3CDC530CE8EA6EDE0D25E01BFBF59FE9AF78A939652E4C129A0D8E1346984F2
SHA-512:	96FDA401C522A135BEC6273B8FCB126FC5CD5D92080965A7B55D8194BB909BCCB69DF051D05F553B4C512723ADECA4400C63EE4DCA7836E36ACE66DBB2EDE276
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....\.x'....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V......}V.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y.z..........................H..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.z..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.z....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j.............6......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5167634358652484
Encrypted:	false
SSDEEP:	48:MEZidOwjGKMsJ8/rlzBdLXuHkkDpG2AZidOwjGKMsJ8/rlzngdLXuHkk+21:Cg3uEkDN1gnIuEkz
MD5:	8572664ECC2A246FDC083DBBD6E855D7
SHA1:	8EDCD1511DDAC9152ACB73320491F03A32AD693E
SHA-256:	297572ECC7780EB901D532E3A7E6A6BD281476B31C1444D49A07B6EC4621716C
SHA-512:	8B0E5833D93BE36600E7932BC23D271A3A078AB3059410A62C31930BE58035F1F1C594042AF054C5D1745C0F356B9F32E16C02976330EFF2A3C64D7D66B8E368
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....\.x'....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y.z..PROGRA~2.........O.I.Y.z....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y.z..........................H..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y.{...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.z..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.z....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j.............6......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579768018866188
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	04be8820c8ffcee33536d8299e5ce0a4
SHA1:	1cbe167f16fc6c296b2738ebcc5b3392a32cdfca
SHA256:	e9d2ca10e32326c624c6c9b0c5eaf1742e8566439ffc817a893ec5a53b55798b
SHA512:	b959c68ad067a47a24a330cc5535263d9b2b7da3a4ca94301149b8c48f5508cd4b53f3529aab36e4b40256b2b3688ab28721b2d7a80bd383192d84966e3ab6c5
SSDEEP:	12288:uqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTC:uqDEvCTbMWu7rQYlBQcBiT6rprG8asC
TLSH:	09159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D09196 [Thu Aug 29 15:19:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F5C4944BAA3h
jmp 00007F5C4944B3AFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F5C4944B58Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F5C4944B55Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F5C4944E14Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F5C4944E198h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F5C4944E181h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	ce319d4bfacde71fcb3f9eec0d76a4c8	False	0.2869010416666667	data	5.1655303048631955	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 17:23:50.156512976 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 29, 2024 17:24:01.671873093 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:01.671894073 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:01.672041893 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:01.672339916 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:01.672364950 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:01.672442913 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:01.673285961 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:01.673291922 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:01.673531055 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:01.673702002 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:01.673707962 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:01.673825979 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:01.674237967 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:01.674249887 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:01.674416065 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:01.674427986 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:01.675116062 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:01.675124884 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:01.676842928 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:01.676851988 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:01.820487022 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:01.820508957 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:01.820566893 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:01.821861029 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:01.821873903 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:01.831432104 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:01.831454992 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:01.831564903 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:01.831594944 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:01.831604958 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:01.831640959 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:01.831935883 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:01.831948042 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:01.832288980 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:01.832304955 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.151173115 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.151310921 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.151648045 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.155431032 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.168486118 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.168494940 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.168642998 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.168649912 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.168941021 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.168946028 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.169095039 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.169109106 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.169708967 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.169775963 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.169795990 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.169863939 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.170037985 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.170085907 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.170227051 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.170288086 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.175674915 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.175735950 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.177154064 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.177216053 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.178606033 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.178687096 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.178922892 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.178929090 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.179043055 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.179104090 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.179224014 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.179234982 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.179491997 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.179497957 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.179573059 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.179578066 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.230375051 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.230410099 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.281354904 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.281439066 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.281443119 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.281495094 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.281639099 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.281650066 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.281899929 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.281903028 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.282624960 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.282677889 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.282782078 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.282876968 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.282886982 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.283910036 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.283953905 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.284055948 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.284122944 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:02.284126043 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:02.299055099 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.299268007 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.299277067 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.300245047 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.300303936 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.301177025 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.301237106 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.301316977 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.344506025 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.417923927 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.417937994 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.437556982 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.437628984 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.437861919 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:02.437870979 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:02.481360912 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.482978106 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.483017921 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.483762980 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.484028101 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.484047890 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.484071016 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.484150887 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.485114098 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.485202074 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.485311031 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.485374928 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.485855103 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.485862970 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.486275911 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.486335039 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.486526012 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.486531973 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.530416965 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.583046913 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.583067894 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.583075047 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.583113909 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.583156109 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.583163977 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.583190918 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.583211899 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.583724976 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.583765030 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.584511042 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.584521055 CEST	443	49756	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.584536076 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.584567070 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.584578991 CEST	49756	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.585688114 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.585706949 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.585772991 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.585783005 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.585834980 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.671942949 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.671951056 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.671989918 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.672004938 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.672010899 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.672019958 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.672049999 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.673574924 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.673599005 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.673635006 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.673641920 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.673691988 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.758387089 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.758410931 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.758465052 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.758500099 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.758508921 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.758548021 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.758549929 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:02.758598089 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.819499969 CEST	49755	443	192.168.2.4	13.107.246.64
Aug 29, 2024 17:24:02.819519043 CEST	443	49755	13.107.246.64	192.168.2.4
Aug 29, 2024 17:24:03.145684004 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.145700932 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.145765066 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.146075964 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.146081924 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.146132946 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.146279097 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.146287918 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.146399975 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.146408081 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.413157940 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.413183928 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.413403034 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.413608074 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.413640976 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.413707972 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.413918018 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.413930893 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.414114952 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.414129019 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.428082943 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.428112030 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.428165913 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.428508043 CEST	49762	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.428515911 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.428633928 CEST	49762	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.428725004 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.428735971 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.428891897 CEST	49762	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.428901911 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.608349085 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.608567953 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.608576059 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.608855963 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.609229088 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.609278917 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.619736910 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.619926929 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.619932890 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.620223045 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.620563984 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.620615959 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.672918081 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.672941923 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.709578037 CEST	49764	443	192.168.2.4	20.75.60.91
Aug 29, 2024 17:24:03.709588051 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:03.709645987 CEST	49764	443	192.168.2.4	20.75.60.91
Aug 29, 2024 17:24:03.709779024 CEST	49764	443	192.168.2.4	20.75.60.91
Aug 29, 2024 17:24:03.709789991 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:03.873910904 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.876305103 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.882435083 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.882447004 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.882757902 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.882790089 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.882797003 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.883097887 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.883136988 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.883203030 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.883445024 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.883502960 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.890633106 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.891588926 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.891614914 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.892602921 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.892668009 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.893771887 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.893830061 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.899816990 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.900026083 CEST	49762	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.900038958 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.901103973 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.901161909 CEST	49762	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.901434898 CEST	49762	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.901500940 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.985745907 CEST	49765	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:03.985764980 CEST	443	49765	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:03.985830069 CEST	49765	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:03.985964060 CEST	49766	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:03.985970020 CEST	443	49766	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:03.986044884 CEST	49766	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:03.986123085 CEST	49767	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:03.986145020 CEST	443	49767	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:03.986277103 CEST	49765	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:03.986285925 CEST	443	49765	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:03.986299992 CEST	49767	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:03.986396074 CEST	49766	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:03.986406088 CEST	443	49766	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:03.986476898 CEST	49767	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:03.986488104 CEST	443	49767	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.016300917 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:04.016343117 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:04.104502916 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:04.104624033 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:04.108503103 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:04.108666897 CEST	49762	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:04.214700937 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:04.214725971 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:04.218772888 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:04.221024990 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:04.221035957 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:04.323182106 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:04.323559046 CEST	49764	443	192.168.2.4	20.75.60.91
Aug 29, 2024 17:24:04.323568106 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:04.324687004 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:04.324805021 CEST	49764	443	192.168.2.4	20.75.60.91
Aug 29, 2024 17:24:04.325759888 CEST	49764	443	192.168.2.4	20.75.60.91
Aug 29, 2024 17:24:04.325829983 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:04.326639891 CEST	49764	443	192.168.2.4	20.75.60.91
Aug 29, 2024 17:24:04.326647043 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:04.420561075 CEST	49764	443	192.168.2.4	20.75.60.91
Aug 29, 2024 17:24:04.457148075 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:04.457169056 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:04.457238913 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:04.457312107 CEST	49764	443	192.168.2.4	20.75.60.91
Aug 29, 2024 17:24:04.458703995 CEST	49764	443	192.168.2.4	20.75.60.91
Aug 29, 2024 17:24:04.458713055 CEST	443	49764	20.75.60.91	192.168.2.4
Aug 29, 2024 17:24:04.458884001 CEST	443	49765	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.459465027 CEST	443	49766	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.459506035 CEST	49765	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.459520102 CEST	443	49765	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.459755898 CEST	49766	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.459764957 CEST	443	49766	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.459821939 CEST	443	49765	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.460097075 CEST	443	49766	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.460465908 CEST	49765	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.460527897 CEST	443	49765	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.460848093 CEST	49766	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.460916042 CEST	443	49766	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.477060080 CEST	443	49767	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.477283001 CEST	49767	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.477300882 CEST	443	49767	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.478296995 CEST	443	49767	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.478584051 CEST	49767	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.479963064 CEST	49767	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.480030060 CEST	443	49767	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.530066967 CEST	49767	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.530080080 CEST	443	49767	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.574698925 CEST	49767	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.613214016 CEST	49765	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.613214016 CEST	49766	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.881858110 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:04.882045984 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:04.884804010 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:04.884810925 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:04.885189056 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:04.938035011 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:04.984503984 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:05.119019985 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.119041920 CEST	443	49769	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.119182110 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.119188070 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.119225979 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.119261026 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.121108055 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.121117115 CEST	443	49769	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.121577024 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.121586084 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.158689022 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:05.158772945 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:05.158845901 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:05.492710114 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:05.492721081 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:05.492733955 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:05.492739916 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:05.497153997 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:05.497163057 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:05.497252941 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:05.497482061 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:05.497492075 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:05.593295097 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.594567060 CEST	49772	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:05.594598055 CEST	443	49772	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:05.594670057 CEST	49772	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:05.595102072 CEST	443	49769	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.595386028 CEST	49772	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:05.595396996 CEST	443	49772	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:05.596656084 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.596662998 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.596919060 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.596925020 CEST	443	49769	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.597181082 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.597232103 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.597296953 CEST	443	49769	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.597347975 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.597892046 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.597938061 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.597978115 CEST	443	49769	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.598017931 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.600964069 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.601013899 CEST	443	49769	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.602967978 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.602972984 CEST	443	49769	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.604337931 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.604409933 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.605107069 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.605113983 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.655599117 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.655616999 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.774014950 CEST	443	49769	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.774848938 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.774882078 CEST	443	49769	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.774940014 CEST	49769	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.780819893 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.782186031 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.782349110 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.784019947 CEST	49770	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:05.784029961 CEST	443	49770	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:05.969510078 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:05.969883919 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:05.969902992 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:05.970937967 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:05.970999956 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:05.972451925 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:05.972527027 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:05.972717047 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:05.972723961 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:06.085632086 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.085659027 CEST	443	49773	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.085724115 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.086008072 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.086014032 CEST	443	49774	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.086113930 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.086515903 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.086527109 CEST	443	49773	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.086644888 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.086653948 CEST	443	49774	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.114697933 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:06.325545073 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:06.325613022 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:06.325647116 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:06.325678110 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:06.325681925 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:06.325694084 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:06.325730085 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:06.325756073 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:06.325825930 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:06.325829983 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:06.325908899 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:06.328713894 CEST	443	49772	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:06.328771114 CEST	49772	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:06.332182884 CEST	49772	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:06.332190990 CEST	443	49772	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:06.332391977 CEST	443	49772	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:06.333785057 CEST	49772	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:06.333864927 CEST	49771	443	192.168.2.4	142.251.40.164
Aug 29, 2024 17:24:06.333877087 CEST	443	49771	142.251.40.164	192.168.2.4
Aug 29, 2024 17:24:06.376497030 CEST	443	49772	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:06.522301912 CEST	443	49772	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:06.522344112 CEST	443	49772	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:06.522427082 CEST	49772	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:06.523358107 CEST	49772	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:06.523372889 CEST	443	49772	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:06.523380995 CEST	49772	443	192.168.2.4	184.28.90.27
Aug 29, 2024 17:24:06.523386002 CEST	443	49772	184.28.90.27	192.168.2.4
Aug 29, 2024 17:24:06.793052912 CEST	443	49773	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.793283939 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.793298006 CEST	443	49773	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.793601036 CEST	443	49773	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.793653011 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.794195890 CEST	443	49773	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.794245005 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.794393063 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.794444084 CEST	443	49773	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.797899008 CEST	443	49774	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.798065901 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.798077106 CEST	443	49774	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.798440933 CEST	443	49774	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.798494101 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.799153090 CEST	443	49774	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.799221039 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.799294949 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.799355030 CEST	443	49774	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.921271086 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.921271086 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.921284914 CEST	443	49773	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.921295881 CEST	443	49774	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:07.035034895 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:07.035103083 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:12.674866915 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:12.674890995 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:12.675133944 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:12.675396919 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:12.675407887 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:12.905061960 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:12.905083895 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:12.905143976 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:12.908895969 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:12.908907890 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.487620115 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:13.487648010 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:13.487926006 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:13.489007950 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:13.489016056 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:13.570009947 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.571317911 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.571326971 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.571630955 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.571641922 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.571682930 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.571687937 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.571737051 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.571737051 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.572225094 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.575052023 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.575102091 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.575285912 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.575289965 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.608618021 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.610279083 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:13.610289097 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.611140013 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.611227036 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:13.613271952 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:13.613323927 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.613756895 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:13.613761902 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.626220942 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.655297041 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:13.709624052 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.709644079 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.709651947 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.709681988 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.709702969 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:13.709709883 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.709734917 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:13.709753036 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:13.711711884 CEST	49780	443	192.168.2.4	13.107.246.42
Aug 29, 2024 17:24:13.711719990 CEST	443	49780	13.107.246.42	192.168.2.4
Aug 29, 2024 17:24:13.750883102 CEST	49672	443	192.168.2.4	173.222.162.32
Aug 29, 2024 17:24:13.750921011 CEST	443	49672	173.222.162.32	192.168.2.4
Aug 29, 2024 17:24:13.845216990 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.845256090 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.845328093 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.845336914 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.848088980 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.848252058 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.848262072 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.854387999 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.854444981 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.854454041 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.860503912 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.860635042 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.860642910 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.866976976 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.867063046 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.867068052 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.873292923 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.873399019 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.873404026 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.879488945 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.879580021 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.879591942 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.885755062 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.885844946 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.885849953 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.936595917 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.937297106 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.937342882 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.937388897 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.937396049 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.940677881 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.940773010 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.940778017 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.946958065 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.946986914 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.947036028 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.947042942 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.947125912 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.954961061 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.960154057 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.960182905 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.960231066 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.960237026 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.960342884 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.965915918 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.972225904 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.972250938 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.972310066 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.972316027 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.972358942 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.995349884 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.995388031 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.995414019 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.995443106 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.995449066 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.995542049 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.995668888 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.997296095 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.997320890 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.997351885 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:13.997356892 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:13.997406960 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.001039982 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.006562948 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.006596088 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.006608009 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.006613970 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.006685019 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.012145042 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.017452955 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.017482042 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.017494917 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.017499924 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.017561913 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.022835016 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.029782057 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.029808044 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.029882908 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.029889107 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.029937983 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.030955076 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.034357071 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.034379959 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.034414053 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.034418106 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.034475088 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.038135052 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.041563988 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.041590929 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.041637897 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.041642904 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.041727066 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.044908047 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.048418045 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.048501015 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.048505068 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.051953077 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.052058935 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.052063942 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.052073002 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.052118063 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.055429935 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.059307098 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.059338093 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.059372902 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.059380054 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.059494972 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.062480927 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.067171097 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.067205906 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.067234993 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.067239046 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.067282915 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.069335938 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.072897911 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.072928905 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.072953939 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.072959900 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.076721907 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.087692976 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.087865114 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.087887049 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.087910891 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.087939024 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.087941885 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.087946892 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.087953091 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.088031054 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.088035107 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.093518019 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.093544006 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.093581915 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.093589067 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.093751907 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.093799114 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.098825932 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.098893881 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.098898888 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.100159883 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.100254059 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.100318909 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.100323915 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.100572109 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.104872942 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.104926109 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.104984045 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.104988098 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.106539011 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.106627941 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.106632948 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.109905005 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.109982967 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.110296011 CEST	49782	443	192.168.2.4	172.217.16.129
Aug 29, 2024 17:24:14.110306025 CEST	443	49782	172.217.16.129	192.168.2.4
Aug 29, 2024 17:24:14.250771999 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:14.250850916 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:14.253900051 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:14.253904104 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:14.254157066 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:14.385735989 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:14.988332987 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:15.028502941 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.243463993 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.243532896 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.243540049 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.243563890 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.243571997 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.243575096 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.243623972 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:15.243632078 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.243640900 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:15.243670940 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:15.243921995 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.243928909 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.243980885 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:15.244007111 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:15.244010925 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.244029999 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.244070053 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:15.926089048 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:15.926104069 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:15.926115990 CEST	49784	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:15.926120996 CEST	443	49784	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:16.118762016 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:16.118814945 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:16.118876934 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:16.119296074 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:16.119316101 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:16.119827986 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.119859934 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.119920969 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.120069981 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.120085955 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.172350883 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.172374010 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.172426939 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.173397064 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.173413038 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.767525911 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.767527103 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:16.767703056 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.767802954 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.767828941 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.768065929 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:16.768085003 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:16.768266916 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.768276930 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.768714905 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.768774033 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.768995047 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:16.769048929 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:16.769148111 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.769201994 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.770133972 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.770193100 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.771116018 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:16.771219015 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:16.771238089 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.771245956 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.771321058 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.771372080 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.771549940 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:16.771558046 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:16.771609068 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.771615982 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.890368938 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:16.890459061 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:16.890969992 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:16.891011000 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:16.904066086 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.904124975 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.904313087 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.904331923 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.904618979 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:16.904670954 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.906254053 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:16.906275034 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:18.779915094 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:18.779944897 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:18.779973030 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:18.779995918 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:18.780028105 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:18.780045033 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:18.784163952 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:18.784236908 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:18.784343958 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:18.784595966 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:18.784642935 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:18.784701109 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:18.800616026 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:18.800688982 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:18.800795078 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:18.810791016 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:18.810954094 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:18.811019897 CEST	49762	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:31.191675901 CEST	49794	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.191709042 CEST	443	49794	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.191776037 CEST	49794	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.191942930 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.191991091 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.192085028 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.192164898 CEST	49794	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.192177057 CEST	443	49794	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.192333937 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.192351103 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.649550915 CEST	443	49794	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.649903059 CEST	49794	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.649923086 CEST	443	49794	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.650234938 CEST	443	49794	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.650754929 CEST	49794	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.650813103 CEST	443	49794	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.650825024 CEST	49794	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.653233051 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.653559923 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.653578043 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.653860092 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.654237986 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.654237986 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.654290915 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.696504116 CEST	443	49794	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.702028990 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.702028990 CEST	49794	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.796272039 CEST	443	49794	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.796336889 CEST	443	49794	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.796504021 CEST	49794	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.796849012 CEST	49794	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.796864033 CEST	443	49794	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.818905115 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.818964005 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.819294930 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.819294930 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.819755077 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 29, 2024 17:24:31.819777966 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:31.820033073 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 29, 2024 17:24:31.820033073 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 29, 2024 17:24:31.820053101 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.125386953 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:32.125418901 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:32.744856119 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.745294094 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 29, 2024 17:24:32.745311975 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.746268988 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.746330023 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 29, 2024 17:24:32.747864962 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 29, 2024 17:24:32.747927904 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.748125076 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 29, 2024 17:24:32.748131990 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.788428068 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 29, 2024 17:24:32.845596075 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.846646070 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.846654892 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.846692085 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.846751928 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:32.847349882 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 29, 2024 17:24:32.860121965 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 29, 2024 17:24:32.860136032 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 29, 2024 17:24:33.090676069 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.090711117 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.090779066 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.090862036 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.090869904 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.090924025 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.091121912 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.091123104 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.091135979 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.091147900 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.545209885 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.545653105 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.545669079 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.546118021 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.546397924 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.546472073 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.553577900 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.553744078 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.553750992 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.554025888 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.554264069 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.554312944 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.592786074 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.608418941 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:48.454616070 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:48.454679012 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:48.454730034 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:48.461833954 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:48.461914062 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:48.461961031 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:49.468308926 CEST	49765	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:49.468308926 CEST	49766	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:49.468333960 CEST	443	49765	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:49.468344927 CEST	443	49766	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:49.530812025 CEST	49767	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:49.530829906 CEST	443	49767	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:51.920963049 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:51.920988083 CEST	443	49773	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:51.921022892 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:51.921029091 CEST	443	49774	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:52.259205103 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:52.259249926 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:52.259337902 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:52.259677887 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:52.259694099 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.278330088 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.278575897 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:53.282418966 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:53.282433987 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.282645941 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.290817022 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:53.336510897 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.609473944 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.609497070 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.609509945 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.609565973 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:53.609587908 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.609632015 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:53.610562086 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.610599041 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.610636950 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:53.610641003 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.610658884 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:53.610886097 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.610937119 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:53.614909887 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:53.614926100 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:53.614938021 CEST	49801	443	192.168.2.4	40.127.169.103
Aug 29, 2024 17:24:53.614943027 CEST	443	49801	40.127.169.103	192.168.2.4
Aug 29, 2024 17:24:56.799983025 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:56.800017118 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:56.800086975 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:56.800260067 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:56.800293922 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:56.800349951 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:56.800442934 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:56.800456047 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:56.800565004 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:56.800576925 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.277353048 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.277800083 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.277817011 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.278134108 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.278512955 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.278568983 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.278573990 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.281729937 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.282489061 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.282506943 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.282819986 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.283082962 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.283142090 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.324508905 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.327222109 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.327222109 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.392891884 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.392957926 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.393111944 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.394438028 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.394455910 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:59.844043970 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:59.844083071 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:59.844134092 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:59.844140053 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.542253017 CEST	49805	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:00.542289019 CEST	443	49805	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:00.542368889 CEST	49805	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:00.542571068 CEST	49805	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:00.542587042 CEST	443	49805	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:01.850374937 CEST	443	49805	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:01.851047039 CEST	49805	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:01.851085901 CEST	443	49805	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:01.851370096 CEST	443	49805	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:01.851726055 CEST	49805	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:01.851784945 CEST	443	49805	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:01.851934910 CEST	49805	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:01.896502018 CEST	443	49805	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:02.063435078 CEST	443	49805	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:02.063743114 CEST	443	49805	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:02.063805103 CEST	49805	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:02.063848972 CEST	49805	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:02.063848972 CEST	49805	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:02.063869953 CEST	443	49805	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:02.063920975 CEST	49805	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:02.064413071 CEST	49806	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:02.064436913 CEST	443	49806	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:02.064505100 CEST	49806	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:02.064659119 CEST	49806	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:02.064670086 CEST	443	49806	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:02.826850891 CEST	443	49806	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:02.827256918 CEST	49806	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:02.827282906 CEST	443	49806	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:02.827568054 CEST	443	49806	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:02.828058958 CEST	49806	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:02.828121901 CEST	443	49806	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:02.828233957 CEST	49806	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:02.872498989 CEST	443	49806	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:03.013297081 CEST	443	49806	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:03.013354063 CEST	443	49806	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:03.013422966 CEST	49806	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:03.013643026 CEST	49806	443	192.168.2.4	23.223.209.213
Aug 29, 2024 17:25:03.013659000 CEST	443	49806	23.223.209.213	192.168.2.4
Aug 29, 2024 17:25:03.795947075 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:03.795968056 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:03.796010017 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:03.796030998 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:03.811593056 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:03.811625957 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:03.811669111 CEST	49762	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:03.811676025 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.983731031 CEST	49725	80	192.168.2.4	88.221.110.91
Aug 29, 2024 17:25:08.003339052 CEST	80	49725	88.221.110.91	192.168.2.4
Aug 29, 2024 17:25:08.003474951 CEST	49725	80	192.168.2.4	88.221.110.91
Aug 29, 2024 17:25:10.612247944 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:10.612267971 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:10.612392902 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:10.612396955 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:12.442002058 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:12.442066908 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:12.442126036 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:34.468385935 CEST	49765	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:25:34.468385935 CEST	49766	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:25:34.468403101 CEST	443	49765	142.250.80.67	192.168.2.4
Aug 29, 2024 17:25:34.468411922 CEST	443	49766	142.250.80.67	192.168.2.4
Aug 29, 2024 17:25:34.530879021 CEST	49767	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:25:34.530891895 CEST	443	49767	142.250.80.67	192.168.2.4
Aug 29, 2024 17:25:36.923068047 CEST	49773	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:25:36.923126936 CEST	443	49773	142.250.65.174	192.168.2.4
Aug 29, 2024 17:25:36.923202038 CEST	49774	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:25:36.923216105 CEST	443	49774	142.250.65.174	192.168.2.4
Aug 29, 2024 17:25:48.798588991 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:48.798589945 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:48.798619986 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:48.798629045 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:48.814673901 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:48.814673901 CEST	49762	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:48.814708948 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:48.814718008 CEST	443	49762	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:57.452783108 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:57.452806950 CEST	443	49802	162.159.61.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 17:23:58.338989973 CEST	53	64861	1.1.1.1	192.168.2.4
Aug 29, 2024 17:23:59.835412979 CEST	63171	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:23:59.835558891 CEST	65435	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.353924990 CEST	53	61273	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.361525059 CEST	53	55246	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.659353971 CEST	49590	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.659501076 CEST	50264	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.660562038 CEST	51821	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.660689116 CEST	61724	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.661098957 CEST	60952	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.661228895 CEST	64400	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.661645889 CEST	55072	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.661786079 CEST	64516	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.666663885 CEST	53	50264	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.667746067 CEST	53	61724	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.668257952 CEST	53	64400	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.668585062 CEST	53	51821	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.668595076 CEST	53	55072	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.668833017 CEST	53	49590	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.668975115 CEST	53	60952	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.669581890 CEST	53	64516	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.802751064 CEST	62228	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.803185940 CEST	56546	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:01.810236931 CEST	53	62228	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:01.810386896 CEST	53	56546	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:03.098787069 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.145345926 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.412770033 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.459219933 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.566767931 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.566868067 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.567096949 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.567198038 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.567210913 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.567451954 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.568872929 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.569650888 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.569817066 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.570250988 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.570374966 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.570482016 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.570775986 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.603945017 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.604011059 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.604022026 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.604114056 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.604182959 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.604362011 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.606858969 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.607021093 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.607526064 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.607712984 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.671156883 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.671199083 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.671474934 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.671485901 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.671907902 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.672179937 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.672189951 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.672718048 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.672877073 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.673348904 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.673886061 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:03.674237967 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.674438953 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.704683065 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.704910994 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.704921007 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.704927921 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.705034971 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.705162048 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.706403971 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.708347082 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.709039927 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.709211111 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.771220922 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:03.797274113 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:03.803339958 CEST	443	60917	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:03.843266010 CEST	60917	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:03.985383987 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.122706890 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.123100996 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.126707077 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.129808903 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.129820108 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.130116940 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.130583048 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.132025957 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.132261992 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.132638931 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.132733107 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.133060932 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.133285046 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.225712061 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.226257086 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.226265907 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.227348089 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.227526903 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.228699923 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.228960991 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.228971004 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.229218006 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.229334116 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.232645988 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.234637022 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.234968901 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.236649036 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.239599943 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.239804029 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.242491007 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.244757891 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.245260954 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.247173071 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.249922991 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.250145912 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.252434969 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.256141901 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.256319046 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.259279966 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.260920048 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.261063099 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.263135910 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.266396046 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.266577005 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.267389059 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.272037983 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.272339106 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.273624897 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.275974035 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.275984049 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.276205063 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.278816938 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.282877922 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.283175945 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.285773993 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.288028955 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.290517092 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.291629076 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.292150974 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.292275906 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.292423964 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.295267105 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.297332048 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.297764063 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.300870895 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.302305937 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.302489996 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.304358006 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.308553934 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.309029102 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.310013056 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.312799931 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.314852953 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.315422058 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.318633080 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.318808079 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.321084976 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.323062897 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.323327065 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.326607943 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.328670025 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.328830957 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.332068920 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.334712982 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.334901094 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.338057995 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.338943005 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.339072943 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.341192961 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.344924927 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.346852064 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.347752094 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.354913950 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.355041981 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.355379105 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.355448008 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.355983973 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.357191086 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.357203007 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.357444048 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.363126040 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.363140106 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.363357067 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.367857933 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.367999077 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.368324995 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.373136044 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.373280048 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.373982906 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.377085924 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.377098083 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.377422094 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.383196115 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.383333921 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.383719921 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.386459112 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.386471033 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.386703014 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.391077995 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.391091108 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.391381025 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.394507885 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.394648075 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.398700953 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.399164915 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.399175882 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.402425051 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.402436018 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.402456045 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.402626991 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.405941010 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.405951977 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.406704903 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.410005093 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.410141945 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.410984993 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.412638903 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.412650108 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.414701939 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.415793896 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.415848970 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.418869972 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.419989109 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.420120001 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.420561075 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.422081947 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.422352076 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.422729969 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.423064947 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.423075914 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.423788071 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.427495003 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.427653074 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.427664042 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.427674055 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.427921057 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.428132057 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.429904938 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.430092096 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.430102110 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.430110931 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.430345058 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.432588100 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.432599068 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.432843924 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.432984114 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.436093092 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.436245918 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.437082052 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.437222958 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.437511921 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.438661098 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.438673019 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.440670967 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.440681934 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.442131996 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.442145109 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.444236994 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.444372892 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.445914030 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.446053028 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.446444035 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.448344946 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.448499918 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.448510885 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.448520899 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.450517893 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.450716019 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.452496052 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.452641010 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.455748081 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.455760002 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.456104994 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.456994057 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.457289934 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.457643032 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.457653999 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.459933996 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.459944010 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.462455034 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.462482929 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.462493896 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.464020014 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.464159012 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.464538097 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.467716932 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.467828989 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.470912933 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.471008062 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.476942062 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.477145910 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.479932070 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.479994059 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.484683990 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.484760046 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.484860897 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.493660927 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.493679047 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.497167110 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.497179031 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.499013901 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.499130964 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.499732018 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.500113010 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.502377987 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.502542973 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.502819061 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.504203081 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.504318953 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.506006956 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.506198883 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.509470940 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.509516954 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.509529114 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.509540081 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.512455940 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.512512922 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.512886047 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.513581038 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.513693094 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.515566111 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.515748978 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.515957117 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.516067028 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.519171953 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.519232035 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.519242048 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.519254923 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.519604921 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.521418095 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.521523952 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.522684097 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.549504995 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.549766064 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.570703030 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.571260929 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.574924946 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.593420982 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.598706961 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.604867935 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.604867935 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.645153999 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.645231009 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.645313025 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.645401955 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.645414114 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.645486116 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.645510912 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.645632029 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.645643950 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.646719933 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.665160894 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.665524006 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.665571928 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.665716887 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.665817976 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.666430950 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.688769102 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.689004898 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.693259001 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.693269968 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.693717003 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.698715925 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.700998068 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.701224089 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:04.721165895 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:04.721446991 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:04.759355068 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.782008886 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.795010090 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:04.819927931 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:04.820919991 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:04.821173906 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:04.821540117 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:04.993998051 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:04.994227886 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:05.093652010 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:05.095163107 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:05.095259905 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:05.114157915 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:05.122066975 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:05.122104883 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:05.122565985 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:05.122606993 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:05.217144966 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:05.217514992 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:05.223155022 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:05.223536015 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:05.223570108 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:05.223577976 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:05.270622969 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:05.270797968 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:05.300299883 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:05.363388062 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:05.364901066 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:05.368488073 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:05.392071009 CEST	443	57151	142.250.80.67	192.168.2.4
Aug 29, 2024 17:24:05.428874969 CEST	57151	443	192.168.2.4	142.250.80.67
Aug 29, 2024 17:24:05.463418961 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:05.466043949 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:05.466988087 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:05.469165087 CEST	443	52966	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:05.496057987 CEST	52966	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:05.777745008 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.084786892 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.326456070 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.326468945 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.326479912 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.331275940 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.439554930 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.439568996 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.439760923 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.440140963 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.441325903 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.441457033 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.441962004 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.441983938 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.442208052 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.541560888 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.541598082 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.541944981 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.542095900 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.551496983 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.551819086 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.551955938 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.620845079 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.621212959 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.623099089 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.639672995 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.640830994 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.640955925 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:06.671720982 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:06.738321066 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:12.892677069 CEST	54588	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:12.893407106 CEST	62280	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:12.899594069 CEST	53	54588	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:12.900212049 CEST	53	62280	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:14.611907959 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:14.734132051 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:14.765481949 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:14.812937021 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:14.813457012 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:14.815403938 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:14.843640089 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:14.935590982 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:15.870029926 CEST	53	53724	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:16.110780001 CEST	51653	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:16.111192942 CEST	56307	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:16.111629009 CEST	49576	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:16.111962080 CEST	56907	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:16.117428064 CEST	53	51653	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:16.118053913 CEST	53	56307	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:16.118252039 CEST	53	49576	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:16.118917942 CEST	53	56907	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:16.163817883 CEST	56748	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:16.163957119 CEST	54868	53	192.168.2.4	1.1.1.1
Aug 29, 2024 17:24:16.170520067 CEST	53	54868	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:16.170540094 CEST	53	56748	1.1.1.1	192.168.2.4
Aug 29, 2024 17:24:19.553822041 CEST	138	138	192.168.2.4	192.168.2.255
Aug 29, 2024 17:24:31.191406965 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.504771948 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.660685062 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.660711050 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.660722971 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.660736084 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.660749912 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.661310911 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.663052082 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.663214922 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.759366035 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.759500980 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.759514093 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.759524107 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.773161888 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.773163080 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:31.869630098 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:31.905327082 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:33.088356018 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:33.088841915 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:33.090044022 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.186053038 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:33.188267946 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:33.188441992 CEST	443	62886	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:33.189127922 CEST	62886	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:33.406766891 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.542912960 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.542942047 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.542952061 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.542983055 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.542994022 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.543379068 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.544982910 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.545151949 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.545392990 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.545515060 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.640647888 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.640722990 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.640999079 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.641206980 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.641223907 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.641371012 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.641664982 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.641865969 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.642154932 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:33.737353086 CEST	443	51128	172.64.41.3	192.168.2.4
Aug 29, 2024 17:24:33.764705896 CEST	51128	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:24:35.101094961 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:35.101095915 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:35.197226048 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:35.233537912 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:35.280747890 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:35.280961990 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:35.283020020 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:35.311682940 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:35.408272982 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:35.862176895 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:36.011066914 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:36.037652969 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:36.037904978 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:36.037992001 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:36.077157974 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:36.159238100 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:36.532538891 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:36.532640934 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:36.628426075 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:36.676383972 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:36.705986977 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:36.709484100 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:36.749886036 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:36.780877113 CEST	49492	443	192.168.2.4	142.250.65.174
Aug 29, 2024 17:24:36.869998932 CEST	443	49492	142.250.65.174	192.168.2.4
Aug 29, 2024 17:24:56.799761057 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.107558966 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.278687000 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.279324055 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.280057907 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.280070066 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.280080080 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.280345917 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.280389071 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.281888008 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.282179117 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.282275915 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.282738924 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.377912045 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.377926111 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.377933979 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.377943039 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.378514051 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.378514051 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.378690958 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.379093885 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.414328098 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:57.473345041 CEST	443	57396	162.159.61.3	192.168.2.4
Aug 29, 2024 17:24:57.516555071 CEST	57396	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:59.845071077 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:59.845259905 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:59.845468044 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:24:59.845582008 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:00.249114990 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:00.291930914 CEST	443	60468	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.292412043 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:00.327028036 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:00.343890905 CEST	443	60468	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.343900919 CEST	443	60468	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.343904018 CEST	443	60468	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.343907118 CEST	443	60468	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.344345093 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:00.344345093 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:00.388536930 CEST	443	60468	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.422307968 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:00.438590050 CEST	443	60468	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.444179058 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:00.540019989 CEST	443	60468	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.540987968 CEST	443	60468	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.541415930 CEST	443	60468	162.159.61.3	192.168.2.4
Aug 29, 2024 17:25:00.541840076 CEST	60468	443	192.168.2.4	162.159.61.3
Aug 29, 2024 17:25:07.205064058 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.205203056 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.205521107 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.205626965 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.609082937 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.626744032 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.626852989 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.707823992 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.708328962 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.748209000 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.779055119 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.779064894 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.779072046 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.779076099 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.779335976 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.779400110 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.780122042 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.780131102 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.780193090 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.780275106 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.780502081 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.781599998 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:07.781702042 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:07.867819071 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.876692057 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.877479076 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.878436089 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.878603935 CEST	443	52696	172.64.41.3	192.168.2.4
Aug 29, 2024 17:25:07.881231070 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.881424904 CEST	52696	443	192.168.2.4	172.64.41.3
Aug 29, 2024 17:25:07.882447958 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:07.882603884 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:08.563301086 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:08.563354015 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.085701942 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.085963011 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.085975885 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.085987091 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.085999966 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.086014032 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.086179972 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.086189985 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.087340117 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.087713003 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.090461016 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.090611935 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.090873003 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.091289043 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:09.091882944 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:09.091938019 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:09.092238903 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.092268944 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.092411995 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.092427969 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.092626095 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:09.186002016 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.186491013 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.186711073 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.186800957 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.188448906 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.188507080 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.188611984 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.189176083 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.190785885 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.191013098 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:09.193047047 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.193088055 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.193711996 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:09.197458029 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.201565981 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.202347994 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.208702087 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.209074020 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:09.212692976 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.213063955 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:09.249512911 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.249986887 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:09.270349979 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.281598091 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:09.292184114 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:09.296469927 CEST	60653	443	192.168.2.4	142.250.31.84
Aug 29, 2024 17:25:09.296828985 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:10.385246038 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:10.385818005 CEST	443	60653	142.250.31.84	192.168.2.4
Aug 29, 2024 17:25:37.376506090 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:37.471301079 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:37.471796036 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:37.471981049 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:37.496627092 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:37.496896982 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:37.567770004 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:37.581756115 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:37.581767082 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:37.581775904 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:37.581984997 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:37.582113981 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:37.584786892 CEST	443	52818	142.251.35.174	192.168.2.4
Aug 29, 2024 17:25:37.610326052 CEST	52818	443	192.168.2.4	142.251.35.174
Aug 29, 2024 17:25:37.679716110 CEST	443	52818	142.251.35.174	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 17:23:59.835412979 CEST	192.168.2.4	1.1.1.1	0x1d4a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:23:59.835558891 CEST	192.168.2.4	1.1.1.1	0xd844	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 29, 2024 17:24:01.659353971 CEST	192.168.2.4	1.1.1.1	0xd666	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.659501076 CEST	192.168.2.4	1.1.1.1	0x9511	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 17:24:01.660562038 CEST	192.168.2.4	1.1.1.1	0x4a67	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.660689116 CEST	192.168.2.4	1.1.1.1	0xe4e7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 17:24:01.661098957 CEST	192.168.2.4	1.1.1.1	0x730e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.661228895 CEST	192.168.2.4	1.1.1.1	0x681c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 17:24:01.661645889 CEST	192.168.2.4	1.1.1.1	0xe961	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.661786079 CEST	192.168.2.4	1.1.1.1	0x60c2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 17:24:01.802751064 CEST	192.168.2.4	1.1.1.1	0xeb2a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.803185940 CEST	192.168.2.4	1.1.1.1	0xe2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 17:24:12.892677069 CEST	192.168.2.4	1.1.1.1	0x2364	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:12.893407106 CEST	192.168.2.4	1.1.1.1	0x7809	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Aug 29, 2024 17:24:16.110780001 CEST	192.168.2.4	1.1.1.1	0x5afe	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:16.111192942 CEST	192.168.2.4	1.1.1.1	0x5b75	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 17:24:16.111629009 CEST	192.168.2.4	1.1.1.1	0x52f7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:16.111962080 CEST	192.168.2.4	1.1.1.1	0x68db	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 17:24:16.163817883 CEST	192.168.2.4	1.1.1.1	0xeecb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:16.163957119 CEST	192.168.2.4	1.1.1.1	0x8dda	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 17:23:59.843307972 CEST	1.1.1.1	192.168.2.4	0x1d4a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:23:59.843491077 CEST	1.1.1.1	192.168.2.4	0xd844	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:01.666663885 CEST	1.1.1.1	192.168.2.4	0x9511	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 17:24:01.667746067 CEST	1.1.1.1	192.168.2.4	0xe4e7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 17:24:01.668257952 CEST	1.1.1.1	192.168.2.4	0x681c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 17:24:01.668585062 CEST	1.1.1.1	192.168.2.4	0x4a67	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.668585062 CEST	1.1.1.1	192.168.2.4	0x4a67	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.668595076 CEST	1.1.1.1	192.168.2.4	0xe961	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.668595076 CEST	1.1.1.1	192.168.2.4	0xe961	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.668833017 CEST	1.1.1.1	192.168.2.4	0xd666	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.668833017 CEST	1.1.1.1	192.168.2.4	0xd666	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.668975115 CEST	1.1.1.1	192.168.2.4	0x730e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.668975115 CEST	1.1.1.1	192.168.2.4	0x730e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.669581890 CEST	1.1.1.1	192.168.2.4	0x60c2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 17:24:01.810236931 CEST	1.1.1.1	192.168.2.4	0xeb2a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.810236931 CEST	1.1.1.1	192.168.2.4	0xeb2a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:01.810386896 CEST	1.1.1.1	192.168.2.4	0xe2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 17:24:01.830029964 CEST	1.1.1.1	192.168.2.4	0x447f	No error (0)	shed.dual-low.s-part-0036.t-0009.t-msedge.net	s-part-0036.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:01.830029964 CEST	1.1.1.1	192.168.2.4	0x447f	No error (0)	s-part-0036.t-0009.t-msedge.net		13.107.246.64	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:11.338146925 CEST	1.1.1.1	192.168.2.4	0xc36f	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:12.672713041 CEST	1.1.1.1	192.168.2.4	0x9a32	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:12.672713041 CEST	1.1.1.1	192.168.2.4	0x9a32	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:12.899594069 CEST	1.1.1.1	192.168.2.4	0x2364	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:12.899594069 CEST	1.1.1.1	192.168.2.4	0x2364	No error (0)	googlehosted.l.googleusercontent.com		172.217.16.129	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:12.900212049 CEST	1.1.1.1	192.168.2.4	0x7809	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:14.144244909 CEST	1.1.1.1	192.168.2.4	0x5ce9	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:14.144244909 CEST	1.1.1.1	192.168.2.4	0x5ce9	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:14.145277977 CEST	1.1.1.1	192.168.2.4	0x5be4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:15.230923891 CEST	1.1.1.1	192.168.2.4	0x174e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:15.231055021 CEST	1.1.1.1	192.168.2.4	0x8d7	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:15.231055021 CEST	1.1.1.1	192.168.2.4	0x8d7	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:16.117428064 CEST	1.1.1.1	192.168.2.4	0x5afe	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:16.117428064 CEST	1.1.1.1	192.168.2.4	0x5afe	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:16.118053913 CEST	1.1.1.1	192.168.2.4	0x5b75	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 17:24:16.118252039 CEST	1.1.1.1	192.168.2.4	0x52f7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:16.118252039 CEST	1.1.1.1	192.168.2.4	0x52f7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:16.118917942 CEST	1.1.1.1	192.168.2.4	0x68db	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 17:24:16.170520067 CEST	1.1.1.1	192.168.2.4	0x8dda	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 17:24:16.170540094 CEST	1.1.1.1	192.168.2.4	0xeecb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:16.170540094 CEST	1.1.1.1	192.168.2.4	0xeecb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:17.258131981 CEST	1.1.1.1	192.168.2.4	0xd23d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:17.258131981 CEST	1.1.1.1	192.168.2.4	0xd23d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:18.352106094 CEST	1.1.1.1	192.168.2.4	0xd23d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:18.352106094 CEST	1.1.1.1	192.168.2.4	0xd23d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:19.355031013 CEST	1.1.1.1	192.168.2.4	0xd23d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:19.355031013 CEST	1.1.1.1	192.168.2.4	0xd23d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:21.477894068 CEST	1.1.1.1	192.168.2.4	0xd23d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:21.477894068 CEST	1.1.1.1	192.168.2.4	0xd23d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 17:24:25.365407944 CEST	1.1.1.1	192.168.2.4	0xd23d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 17:24:25.365407944 CEST	1.1.1.1	192.168.2.4	0xd23d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
2024-08-29 15:24:31 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	true
2024-08-29 15:24:31 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	true
2024-08-29 15:24:31 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	true

HTTP Request Dependency Graph

chrome.cloudflare-dns.com

edgeassetservice.azureedge.net

arc.msn.com

https:

www.google.com

fs.microsoft.com

clients2.googleusercontent.com

slscr.update.microsoft.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

bzib.nelreports.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49751	162.159.61.3	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 15:24:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8bb1ff9542cc-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 09 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49750	162.159.61.3	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 15:24:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8bb1f8fc42df-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49752	172.64.41.3	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 15:24:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8bb1faf58cda-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 14 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49753	162.159.61.3	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 15:24:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8bb1fe8b8ce8-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&Q)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49754	172.64.41.3	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 15:24:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8bb2ee707cb4-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 07 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49756	13.107.246.64	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:02 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 15:24:02 UTC	559	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 15:24:02 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240829T152402Z-16579567576l4p9bs8an1npq1n00000001t000000000qkhr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-29 15:24:02 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49755	13.107.246.64	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:02 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 15:24:02 UTC	583	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 15:24:02 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240829T152402Z-16579567576p25xcxh3nycmsaw00000001r000000000kr9p Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-29 15:24:02 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-29 15:24:02 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-29 15:24:02 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-29 15:24:02 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-29 15:24:02 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49764	20.75.60.91	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:04 UTC	616	OUT	GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=4839256027653960672&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1 Host: arc.msn.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 15:24:04 UTC	633	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400, private Content-Length: 2061 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"X-RADID":"P425775005-T700421790-C128000000003081749"},{"BATCH_REDIRECT_STORE":"B128000000003081749+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 29 Aug 2024 15:24:03 GMT Connection: close
2024-08-29 15:24:04 UTC	2061	IN	Data Raw: 7b 22 66 22 3a 22 72 61 66 22 2c 22 76 22 3a 22 31 2e 30 22 2c 22 72 64 72 22 3a 5b 7b 22 63 22 3a 22 41 6e 61 68 65 69 6d 20 50 61 73 73 77 6f 72 64 20 4d 6f 6e 69 74 6f 72 22 2c 22 75 22 3a 22 43 6f 6e 73 65 6e 74 20 53 61 76 65 20 50 61 73 73 77 6f 72 64 22 7d 5d 2c 22 61 64 22 3a 7b 22 54 49 54 4c 45 5f 53 41 56 45 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 55 50 44 41 54 45 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 53 41 56 45 44 5f 50 41 53 53 57 4f 52 44 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 4e 4f 5f 53 41 56 45 44 5f 50 41 53 53 57 4f 52 44 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 Data Ascii: {"f":"raf","v":"1.0","rdr":[{"c":"Anaheim Password Monitor","u":"Consent Save Password"}],"ad":{"TITLE_SAVE":"Save your password","TITLE_UPDATE":"Save your password","TITLE_SAVED_PASSWORD":"Save your password","TITLE_NO_SAVED_PASSWORD":"Save your password

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49768	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:04 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-29 15:24:05 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=151968 Date: Thu, 29 Aug 2024 15:24:05 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49769	142.250.65.174	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:05 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-29 15:24:05 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 29 Aug 2024 15:24:05 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49770	142.250.65.174	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:05 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-29 15:24:05 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 29 Aug 2024 15:24:05 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49771	142.251.40.164	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:05 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-29 15:24:06 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 29 Aug 2024 14:51:55 GMT Expires: Fri, 06 Sep 2024 14:51:55 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 1931 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-29 15:24:06 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-29 15:24:06 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-29 15:24:06 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-29 15:24:06 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-29 15:24:06 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49772	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:06 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-29 15:24:06 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=151920 Date: Thu, 29 Aug 2024 15:24:06 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-29 15:24:06 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49782	172.217.16.129	443	8804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:13 UTC	594	OUT	GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 15:24:13 UTC	565	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AHxI1nOlNPzSvks0toqnVlrXKlGUwO4T2vDVBe5if_3sEqPbzwzE3cGVoxOULIQRaMG12TXOkL8 X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Thu, 29 Aug 2024 14:27:46 GMT Expires: Fri, 29 Aug 2025 14:27:46 GMT Cache-Control: public, max-age=31536000 Age: 3387 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-29 15:24:13 UTC	825	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-08-29 15:24:13 UTC	1390	IN	Data Raw: 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 17 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-08-29 15:24:13 UTC	1390	IN	Data Raw: 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 a2 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-08-29 15:24:13 UTC	1390	IN	Data Raw: 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c 0d Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-08-29 15:24:13 UTC	1390	IN	Data Raw: 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe e3 Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-08-29 15:24:13 UTC	1390	IN	Data Raw: 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 49 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,pI
2024-08-29 15:24:13 UTC	1390	IN	Data Raw: 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 61 Data Ascii: =%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhPa
2024-08-29 15:24:13 UTC	1390	IN	Data Raw: c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 c3 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-08-29 15:24:13 UTC	1390	IN	Data Raw: 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 90 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-08-29 15:24:13 UTC	1390	IN	Data Raw: 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f 97 Data Ascii: N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49780	13.107.246.42	443	8804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:13 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 15:24:13 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 15:24:13 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240829T152413Z-16579567576l8zffr7mt4xy2un00000001n000000000unqy Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-29 15:24:13 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49784	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x7wvDNpW4uDZky9&MD=92YTSceG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-29 15:24:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 10344b38-cb38-4c56-a8fb-367a25ef724c MS-RequestId: f93c4720-4427-4dc5-93c1-677dd8624408 MS-CV: UM/CAF1LWk+3aMYD.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 29 Aug 2024 15:24:14 GMT Connection: close Content-Length: 24490
2024-08-29 15:24:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-29 15:24:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49790	162.159.61.3	443	8804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 15:24:16 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:16 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8c0d5ac34257-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:16 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 06 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49789	172.64.41.3	443	8804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 15:24:16 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:16 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8c0d4c53437e-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:16 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49791	162.159.61.3	443	8804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 15:24:16 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:16 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8c0d5c3c7c94-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:16 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0d 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49794	162.159.61.3	443	8804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA)/+
2024-08-29 15:24:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8c6a6ebf7286-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 06 00 01 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d d0 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 01 51 40 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 00 ec 00 1c 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 09 61 7a 75 72 65 65 64 67 65 c0 b3 c0 c4 00 05 00 01 00 00 06 c8 00 15 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 02 65 63 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA4starsftludldeliverympmicrosoftcomdelivery3RQ@&cdp-f-ssl-tlu-nettrafficmanagernetwildcardtlu-sslazureedgewildcardtlu-sslec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49795	162.159.61.3	443	8804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcom)/+
2024-08-29 15:24:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8c6a69205e7c-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 07 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0c b4 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 01 50 24 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 01 2c 00 1c 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 09 61 7a 75 72 65 65 64 67 65 c0 b3 c0 c4 00 05 00 01 00 00 07 08 00 15 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 02 65 63 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcom4starsftludldeliverympmicrosoftcomdelivery3RP$&cdp-f-ssl-tlu-nettrafficmanagernet,wildcardtlu-sslazureedgewildcardtlu-sslec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49796	152.195.19.97	443	8804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:32 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725549854&P2=404&P3=2&P4=dcKdhpSfkT5msp%2f6XO5uLNteytiH9SJ2NiW2YvvdwjhPJz8s8d4bjtkfZgwyN%2bkNG0juB9rgoq86xOXyL4iYfg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: s12wh6zBt+PqlbI3Jzl4Uo Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 15:24:32 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4871603 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Thu, 29 Aug 2024 15:24:32 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-08-29 15:24:32 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49801	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:53 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x7wvDNpW4uDZky9&MD=92YTSceG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-29 15:24:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 0750300c-80f0-495a-ae45-f334d4ce6398 MS-RequestId: 9a9d8a93-c980-437b-b364-6b6d7923774c MS-CV: qAjDIHo3hk6O+uZV.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 29 Aug 2024 15:24:52 GMT Connection: close Content-Length: 30005
2024-08-29 15:24:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-29 15:24:53 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49803	162.159.61.3	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:24:57 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 15:24:57 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-08-29 15:24:57 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 15:24:57 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bad8d0a6b0a7c8d-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 15:24:57 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d ef 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 1b 00 02 c0 43 c0 43 00 01 00 01 00 00 00 1b 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 1b 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCOCk)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49805	23.223.209.213	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:25:01 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 15:25:02 UTC	361	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: content-type Date: Thu, 29 Aug 2024 15:25:02 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.d5bbd717.1724945101.246b9a31 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49806	23.223.209.213	443	8104	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 15:25:02 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 466 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 15:25:02 UTC	466	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 39 35 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 31 32 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e Data Ascii: [{"age":59953,"body":{"elapsed_time":1123,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bin
2024-08-29 15:25:03 UTC	359	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Date: Thu, 29 Aug 2024 15:25:02 GMT Content-Length: 21 Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.d5bbd717.1724945102.246bc418 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-08-29 15:25:03 UTC	21	IN	Data Raw: 50 72 6f 63 65 73 73 65 64 20 74 68 65 20 72 65 71 75 65 73 74 Data Ascii: Processed the request

Target ID:	0
Start time:	11:23:54
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc0000
File size:	917'504 bytes
MD5 hash:	04BE8820C8FFCEE33536D8299E5CE0A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:23:54
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:23:55
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2096,i,6555085097696999869,11138024300958431153,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:23:55
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:23:55
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	11:23:59
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6256 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:23:59
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6500 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:24:00
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7224 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff65dc80000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:24:00
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7224 --field-trial-handle=2204,i,12086637775297048705,4720430361987202532,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff65dc80000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:24:09
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:24:10
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3496 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	11:24:10
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4256 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:24:11
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8
Imagebase:	0x7ff65dc80000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:24:11
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2832,i,5965972730732482156,16209170947700077090,262144 /prefetch:8
Imagebase:	0x7ff65dc80000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:24:17
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:24:18
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1904,i,904783541810693917,8997423622373591723,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:24:25
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:24:26
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2060,i,1564144470648911269,596232367200528838,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:24:38
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:24:39
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2052,i,125651995500428763,9374026523037339469,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.9%
Total number of Nodes:	1395
Total number of Limit Nodes:	45

Executed Functions

Function 000C42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 000C430D

Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A

GetCurrentProcess.KERNEL32(?,0015CB64,00000000,?,?), ref: 000C4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 000C4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 000C4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 000C4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 000C4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 000C447B
GetSystemInfo.KERNEL32(?,?,?), ref: 000C44A0

Strings

kernel32.dll, xrefs: 000C444F
|O, xrefs: 001036F8
GetNativeSystemInfo, xrefs: 000C4460

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 4163626d5772927278403cfea605f28f49a57f836d3b1fdd8a9b53bf3e80218d
Instruction ID: db7587102a40a58df5881e0f1bc71648e5fcf250f3e98e4bbb80a9438556a350
Opcode Fuzzy Hash: 4163626d5772927278403cfea605f28f49a57f836d3b1fdd8a9b53bf3e80218d
Instruction Fuzzy Hash: 3FA18376D0A3C2FFC716CB6A78416AD7FB87B26320B18449ED49197E62D36047C8CB61

Function 000C42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,000C50AA,?,?,00000000,00000000), ref: 000C42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,000C50AA,?,?,00000000,00000000), ref: 000C42C9
LoadResource.KERNEL32(?,00000000,?,?,000C50AA,?,?,00000000,00000000,?,?,?,?,?,?,000C4F20), ref: 001035BE
SizeofResource.KERNEL32(?,00000000,?,?,000C50AA,?,?,00000000,00000000,?,?,?,?,?,?,000C4F20), ref: 001035D3
LockResource.KERNEL32(000C50AA,?,?,000C50AA,?,?,00000000,00000000,?,?,?,?,?,?,000C4F20,?), ref: 001035E6

Strings

SCRIPT, xrefs: 000C42BF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: d76a7e9d54f7317ce1fcaadf43784a9dcaf41a1448cac42d0c233214586b4fe7
Instruction ID: 82bd68b8611ed767056485405dd692ce703ab16ce168d5a52986b413788a9dbf
Opcode Fuzzy Hash: d76a7e9d54f7317ce1fcaadf43784a9dcaf41a1448cac42d0c233214586b4fe7
Instruction Fuzzy Hash: 6F117C70600700FFD7218F65DC49F2B7BB9EBC5B52F20416DB8169A6A0DB71D840DA60

Function 00102BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 000C2B6B

Part of subcall function 000C3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00191418,?,000C2E7F,?,?,?,00000000), ref: 000C3A78

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00182224), ref: 00102C10
ShellExecuteW.SHELL32(00000000,?,?,00182224), ref: 00102C17

Strings

runas, xrefs: 00102C0B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: ad5e5758312ad20f220a489543da50711b52bfcdb5c71a7c4e292bad0076558b
Instruction ID: 679c2b2f75c00d100f84de83dfcfcf83a512bd1902dfed9549f553438934faa0
Opcode Fuzzy Hash: ad5e5758312ad20f220a489543da50711b52bfcdb5c71a7c4e292bad0076558b
Instruction Fuzzy Hash: 7311E631208342AACB14FF60D896FFEBBA5AF95300F44542DF082174A3CF318A8AC752

Function 0012DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00105222), ref: 0012DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0012DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0012DBEE
FindClose.KERNEL32(00000000), ref: 0012DBFA

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: def91458aadf37262f6dc29bf64214f0161d874ae701f306d898c94f327c03a1
Instruction ID: c370d8df1162d1e897619221db79ca135d4e1cc66fae14f974dc8b436ed284cc
Opcode Fuzzy Hash: def91458aadf37262f6dc29bf64214f0161d874ae701f306d898c94f327c03a1
Instruction Fuzzy Hash: B1F0A030810B209B82246F78FC0D8AA376D9F02336B10470AF836D24E0EBB059B4C6D6

Function 0014AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0014B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0014B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0014B1D4
_wcslen.LIBCMT ref: 0014B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0014B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0014B236
_wcslen.LIBCMT ref: 0014B332

Part of subcall function 001305A7: GetStdHandle.KERNEL32(000000F6), ref: 001305C6

_wcslen.LIBCMT ref: 0014B34B
_wcslen.LIBCMT ref: 0014B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0014B3B6
GetLastError.KERNEL32(00000000), ref: 0014B407
CloseHandle.KERNEL32(?), ref: 0014B439
CloseHandle.KERNEL32(00000000), ref: 0014B44A
CloseHandle.KERNEL32(00000000), ref: 0014B45C
CloseHandle.KERNEL32(00000000), ref: 0014B46E
CloseHandle.KERNEL32(?), ref: 0014B4E3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: bc1255fc4407e78ca71bf447afc069c3813308f3c6c28688705e64d18f4ac1f9
Instruction ID: 57007b457383b4ece040b3c5ecc82f850602d4a5b9f61c2d314e7d55f49cdb79
Opcode Fuzzy Hash: bc1255fc4407e78ca71bf447afc069c3813308f3c6c28688705e64d18f4ac1f9
Instruction Fuzzy Hash: 4BF18B316083409FC714EF24C891B6EBBE5BF85714F18855DF89A9B2A2CB71EC45CB92

Function 000CD730 Relevance: 21.6, APIs: 14, Instructions: 631windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 000CD807
timeGetTime.WINMM ref: 000CDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000CDB28
TranslateMessage.USER32(?), ref: 000CDB7B
DispatchMessageW.USER32(?), ref: 000CDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000CDB9F
Sleep.KERNELBASE(0000000A), ref: 000CDBB1

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: da46ec748cd7d2717f624f88faa56b59fdb46eafd773f3eb6b05b8b5e8116f98
Instruction ID: 55cee646107b16d88bcb72dce43a50625d4022677e09d370cec81926d059cb38
Opcode Fuzzy Hash: da46ec748cd7d2717f624f88faa56b59fdb46eafd773f3eb6b05b8b5e8116f98
Instruction Fuzzy Hash: 2642AE30608342EFD728DF24C885FAEB7E1BF86304F14456EE5568B692D770A894DB92

Function 000C2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 000C2D07
RegisterClassExW.USER32(00000030), ref: 000C2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000C2D42
InitCommonControlsEx.COMCTL32(?), ref: 000C2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000C2D6F
LoadIconW.USER32(000000A9), ref: 000C2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 000C2D94

Strings

TaskbarCreated, xrefs: 000C2D37
0, xrefs: 000C2CE9
+, xrefs: 000C2CF0
AutoIt v3 GUI, xrefs: 000C2D23

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 67de3d04cbce7eaac04c98d75b28353ac3b286e51f674e27bc55d62b0453c15d
Instruction ID: be21fe7e0f91b3c0d721edfd9c1b17c86909716ac55c3459bb1d50b7e0575016
Opcode Fuzzy Hash: 67de3d04cbce7eaac04c98d75b28353ac3b286e51f674e27bc55d62b0453c15d
Instruction Fuzzy Hash: C621F2B5901309EFDB00DFA4EC89BDDBBB4FB08706F00811AF911AAAA0D7B10584CF90

Function 0010065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0010039A: CreateFileW.KERNELBASE(00000000,00000000,?,00100704,?,?,00000000,?,00100704,00000000,0000000C), ref: 001003B7

GetLastError.KERNEL32 ref: 0010076F
__dosmaperr.LIBCMT ref: 00100776
GetFileType.KERNELBASE(00000000), ref: 00100782
GetLastError.KERNEL32 ref: 0010078C
__dosmaperr.LIBCMT ref: 00100795
CloseHandle.KERNEL32(00000000), ref: 001007B5
CloseHandle.KERNEL32(?), ref: 001008FF
GetLastError.KERNEL32 ref: 00100931
__dosmaperr.LIBCMT ref: 00100938

Strings

H, xrefs: 001008BD

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 25838155a07724deea7506e28cf2246fd269850ebacd07b7104b1603ccda9686
Instruction ID: 1323a7bc6bad1d214352c7f7926564c9b0b1155769eef22b43f1cade7152fca9
Opcode Fuzzy Hash: 25838155a07724deea7506e28cf2246fd269850ebacd07b7104b1603ccda9686
Instruction Fuzzy Hash: 86A12732A002488FDF1AAF68DC51BAD7BA0EB0A320F14415EF855AF3D2D7759D52CB91

Function 000C344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00191418,?,000C2E7F,?,?,?,00000000), ref: 000C3A78

Part of subcall function 000C3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 000C3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 000C356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0010318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 001031CE
RegCloseKey.ADVAPI32(?), ref: 00103210
_wcslen.LIBCMT ref: 00103277
_wcslen.LIBCMT ref: 00103286

Strings

Include, xrefs: 00103184, 001031C5
\, xrefs: 0010328C
\Include\, xrefs: 000C3527
Software\AutoIt v3\AutoIt, xrefs: 000C3560

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 03b366c67cff9eef8fac6d7d844592ee276424da78b62220d81057035815aea4
Instruction ID: af32e742863418d70d3f016eeb32dd102594d11a6e200a039f543b555654bf6b
Opcode Fuzzy Hash: 03b366c67cff9eef8fac6d7d844592ee276424da78b62220d81057035815aea4
Instruction Fuzzy Hash: 5471A171505301AEC314DF25DC82DAFBBE8FF89340F40452EF495971A1EB709A88CBA1

Function 000C2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 000C2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 000C2B9D
LoadIconW.USER32(00000063), ref: 000C2BB3
LoadIconW.USER32(000000A4), ref: 000C2BC5
LoadIconW.USER32(000000A2), ref: 000C2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 000C2BEF
RegisterClassExW.USER32(?), ref: 000C2C40

Part of subcall function 000C2CD4: GetSysColorBrush.USER32(0000000F), ref: 000C2D07
Part of subcall function 000C2CD4: RegisterClassExW.USER32(00000030), ref: 000C2D31
Part of subcall function 000C2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000C2D42
Part of subcall function 000C2CD4: InitCommonControlsEx.COMCTL32(?), ref: 000C2D5F
Part of subcall function 000C2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000C2D6F
Part of subcall function 000C2CD4: LoadIconW.USER32(000000A9), ref: 000C2D85
Part of subcall function 000C2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 000C2D94

Strings

AutoIt v3, xrefs: 000C2C2F
0, xrefs: 000C2C0F
#, xrefs: 000C2C16

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: f4e985a3e25f49e24d66b73e1dff63fd20246cfa61c166f0e8fd7e89ed860d6c
Instruction ID: fe26e3582c81eb33e1c8bf37f8c71140ac77193b9c675fbedcdc58c8f1bc6d6e
Opcode Fuzzy Hash: f4e985a3e25f49e24d66b73e1dff63fd20246cfa61c166f0e8fd7e89ed860d6c
Instruction Fuzzy Hash: 24210770E10319BFDB109FA5EC95AAD7FB4FB48B60F04412BE504A6AA0D7B516C0CF90

Function 000C3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,000C316A,?,?), ref: 000C31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,000C316A,?,?), ref: 000C3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 000C3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,000C316A,?,?), ref: 000C3232
CreatePopupMenu.USER32 ref: 000C3246
PostQuitMessage.USER32(00000000), ref: 000C3267

Strings

TaskbarCreated, xrefs: 000C322D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: cb46c58e6f1c2bbcd426eaec965165d7bafa7c7d0d5f2b07c52a5e548869d478
Instruction ID: cd355492a345d4dfcc7de5553b5c1b6df36b864a425c3d3cd418806d0746e26f
Opcode Fuzzy Hash: cb46c58e6f1c2bbcd426eaec965165d7bafa7c7d0d5f2b07c52a5e548869d478
Instruction Fuzzy Hash: CF41F835264305BEDF251B789D0EFBD3A65E709354F08811EF90196992CB718EC09BA1

Function 000C2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 000C2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 000C2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,000C1CAD,?), ref: 000C2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,000C1CAD,?), ref: 000C2CCF

Strings

AutoIt v3, xrefs: 000C2C89, 000C2C8E, 000C2C8F
edit, xrefs: 000C2CAC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: c2a1766012652c63616c3f8a17f2384799addf727d85c704eb20f6d8e0103e20
Instruction ID: 555858e77866bac33c99a308619502770e0a3a0de833dc73a82619dd23d1d54b
Opcode Fuzzy Hash: c2a1766012652c63616c3f8a17f2384799addf727d85c704eb20f6d8e0103e20
Instruction Fuzzy Hash: C7F0DA75540391BEEB311B27AC08E773EBDE7CAF61B00005AFD14A69A0C67119D4DAB1

Function 0012E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0012E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0012E9A5
Sleep.KERNEL32(00000000), ref: 0012E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0012E9B7
Sleep.KERNELBASE ref: 0012E9F3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 5722cfd8e1770e25627ec113d6ff09b00caf4f03cb4d30986c5d789fae415ad1
Instruction ID: 7e696ec471462dfb12bf3799b62137f7ab2d2f4082337ff6a3991765756c4a7d
Opcode Fuzzy Hash: 5722cfd8e1770e25627ec113d6ff09b00caf4f03cb4d30986c5d789fae415ad1
Instruction Fuzzy Hash: 41011731C01A39DBCF00AFE5E899AEDBBB8BB09705F010556E502B2241CB3495A4CBA1

Function 000C3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,000C3B0F,SwapMouseButtons,00000004,?), ref: 000C3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,000C3B0F,SwapMouseButtons,00000004,?), ref: 000C3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,000C3B0F,SwapMouseButtons,00000004,?), ref: 000C3B83

Strings

Control Panel\Mouse, xrefs: 000C3B3E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 97fb02fb39f1050f6d84a9fb68eb34c8ed1313218f22f1c37adb634a02781225
Instruction ID: f4b6254dbcab8f999431eebd78de3660539647761d391235f085f1c03dc3d8bd
Opcode Fuzzy Hash: 97fb02fb39f1050f6d84a9fb68eb34c8ed1313218f22f1c37adb634a02781225
Instruction Fuzzy Hash: 66112AB5520208FFDB608FA5DC44EEFB7BCEF44755B108459BA05D7150D3319E409BA0

Function 000C3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 001033A2

Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 000C3A04

Strings

Line: , xrefs: 001033EB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: faf099b89b40d2714237635b94ed07e1149c3e9efa287b5a93bccc10875bdd4d
Instruction ID: d24c7d4d8b9e56d99962dacae7caeb79f1e62206e2ea377e4b29f5604a9d7308
Opcode Fuzzy Hash: faf099b89b40d2714237635b94ed07e1149c3e9efa287b5a93bccc10875bdd4d
Instruction Fuzzy Hash: 8431C171518305AED725EB20DC46FEFB7E8AB40720F00892EF59993592DB709B89C7C2

Function 000DFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000E0668

Part of subcall function 000E32A4: RaiseException.KERNEL32(?,?,?,000E068A,?,00191444,?,?,?,?,?,?,000E068A,000C1129,00188738,000C1129), ref: 000E3304

__CxxThrowException@8.LIBVCRUNTIME ref: 000E0685

Strings

Unknown exception, xrefs: 000E0692

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 7ebbaa5cc9a1f1de4de363476c0e1e696995e2c1dbd0974cf9af060bb7d8e95e
Instruction ID: 42c8da9bfb702ed683406a43a58495406c7d7ef068cf3c2404e29fc82b78b6bc
Opcode Fuzzy Hash: 7ebbaa5cc9a1f1de4de363476c0e1e696995e2c1dbd0974cf9af060bb7d8e95e
Instruction Fuzzy Hash: D2F0C83490038DBBCB10B666D846DDE7BBD5F40310BA04535B924F65D2EFB1DB55CA90

Function 000C10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 000C1BF4
Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 000C1BFC
Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 000C1C07
Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 000C1C12
Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 000C1C1A
Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 000C1C22

Part of subcall function 000C1B4A: RegisterWindowMessageW.USER32(00000004,?,000C12C4), ref: 000C1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 000C136A
OleInitialize.OLE32 ref: 000C1388
CloseHandle.KERNEL32(00000000,00000000), ref: 001024AB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 255e64accd2c28844879f1896aaa154d86f47f5b771580fcaf2d83d02006b13e
Instruction ID: 51b19cdaaf0505a943bdb5370a3129b00d8625052b37545a85874a1a374d7769
Opcode Fuzzy Hash: 255e64accd2c28844879f1896aaa154d86f47f5b771580fcaf2d83d02006b13e
Instruction Fuzzy Hash: B271CFB4901303AFE785DF79AA45A993AE1FB8A344357822FD41AD7B62EB3044C5CF41

Function 0012C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 000C3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0012C259
KillTimer.USER32(?,00000001,?,?), ref: 0012C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0012C270

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 8a57c42460f05bc92858ea1b29bfbdb8a09aef5f65e4c4ab187d88713807e86e
Instruction ID: 5cf572107fb08a5f805b10cee61c0099c0c8c9fc1a1d09e2f70ac94921ee6cfc
Opcode Fuzzy Hash: 8a57c42460f05bc92858ea1b29bfbdb8a09aef5f65e4c4ab187d88713807e86e
Instruction Fuzzy Hash: FB31C570904354EFEB26DF64A855BEBBBECAF16304F00049ED2DA97241C7745A84CB91

Function 000F86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,000F85CC,?,00188CC8,0000000C), ref: 000F8704
GetLastError.KERNEL32(?,000F85CC,?,00188CC8,0000000C), ref: 000F870E
__dosmaperr.LIBCMT ref: 000F8739

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: a28971cf563fc162dbc94362d74cb1ba01aff939504861363a9b69eadb4b444d
Instruction ID: d7169c14a8ec4a80ba0a944bd0e38212085f0bfae8e6ab91dc2ad744c60cd834
Opcode Fuzzy Hash: a28971cf563fc162dbc94362d74cb1ba01aff939504861363a9b69eadb4b444d
Instruction Fuzzy Hash: 2E014C336047285AC2A062346C497FE37C54B82779F254119EB04DB9D3DE60CD81A390

Function 000CDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 000CDB7B
DispatchMessageW.USER32(?), ref: 000CDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000CDB9F
Sleep.KERNELBASE(0000000A), ref: 000CDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00111CC9

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 65cc1173bde993173c4c3bedad73afbd2bc4109abb64ba1bb540f94fbc09ae33
Instruction ID: 506f5838a1ee4ef7f8c55fc901c628f66792f0d6e46a70e4bec5a621fc9da3e3
Opcode Fuzzy Hash: 65cc1173bde993173c4c3bedad73afbd2bc4109abb64ba1bb540f94fbc09ae33
Instruction Fuzzy Hash: 33F05430644381EBE734CB60CC45FDE73ACEB44311F504529E60A874C0DB3094C89B65

Function 000D1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 000D17F6

Strings

CALL, xrefs: 000D17C6

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: fcf8ca0b771e8a5785ff65c0fc84022fae8947d9d2d86aac098c255b522e7c96
Instruction ID: 308528c44cec28ed306c58f38d0e974840aa8552e43bc58a9241bddc3e1cd597
Opcode Fuzzy Hash: fcf8ca0b771e8a5785ff65c0fc84022fae8947d9d2d86aac098c255b522e7c96
Instruction Fuzzy Hash: F1228E70608301EFC714DF14D484AAABBF1BF85314F14856EF49A8B362DB76E985CB62

Function 000C2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00102C8C

Part of subcall function 000C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000C3A97,?,?,000C2E7F,?,?,?,00000000), ref: 000C3AC2

Part of subcall function 000C2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000C2DC4

Strings

X, xrefs: 00102C5A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 8949581d72b05628e57ca6a6395ab7691f592e379477b4a7e28ea09b654f0b43
Instruction ID: 3f137b3d2f21d416521dda66e55c7defd06fe712f4accad0d8fffebac898d2bd
Opcode Fuzzy Hash: 8949581d72b05628e57ca6a6395ab7691f592e379477b4a7e28ea09b654f0b43
Instruction Fuzzy Hash: C2217571A102589FDB11EF94C849BEE7BFCAF49314F00805DE545BB281DBF45A898FA1

Function 000C3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 000C3908

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: e9518a028b3783e991c15940804d047f04c89f54857e8176bc306f8daf2380ac
Instruction ID: e996329e0dbd43ae21edc3b36fa6cb3e57f568df8d932491f2e056a3fa39fd41
Opcode Fuzzy Hash: e9518a028b3783e991c15940804d047f04c89f54857e8176bc306f8daf2380ac
Instruction Fuzzy Hash: 8A319170504301DFD760DF24D885B9BBBF8FB49718F00092EF59987680E7B1AA88CB92

Function 000DF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000DF661

Part of subcall function 000CD730: GetInputState.USER32 ref: 000CD807

Sleep.KERNEL32(00000000), ref: 0011F2DE

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 6461a9be7095ccea23ab87778ae3c74221a30a40b2ba000bd28253af4d2cb4b7
Instruction ID: e783cd76d78ac6c69b983e8aa0766d0bf1cdd9883ffe9d30566ca50c1ae58ff6
Opcode Fuzzy Hash: 6461a9be7095ccea23ab87778ae3c74221a30a40b2ba000bd28253af4d2cb4b7
Instruction Fuzzy Hash: EFF05831240B059FD314EF69D44AFAEB7E8AB59761F00402AF85ACB7A1DB70A8408B90

Function 000CB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 000CBB4E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 5b268de1cbb0d5d3e23be15d1b637e02bd8e38ce239be8dc1febe6f2d4f75033
Instruction ID: f9378a0d6214b1129e4a7bcdb8cfa59961e70530dd6cfae57127ea7de0947396
Opcode Fuzzy Hash: 5b268de1cbb0d5d3e23be15d1b637e02bd8e38ce239be8dc1febe6f2d4f75033
Instruction Fuzzy Hash: 0C328D34A04209AFDB29CF54C895FBEB7B9FF48310F15806AE915AB251C7B4EE81CB51

Function 00152598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00152649

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: b1cc2bc9bfa48baac806c5629a864adfe691166e3cacddcc319f3fa775511876
Instruction ID: 71c29f84ec4e733c6e5ac39e27431bf3c0fe2641d14cfd0b01c7b0e4df0412e9
Opcode Fuzzy Hash: b1cc2bc9bfa48baac806c5629a864adfe691166e3cacddcc319f3fa775511876
Instruction Fuzzy Hash: CC21F276200615EFE710DF14C8D0E76B79AEB56369B60806CEC668F392C771ED45CB90

Function 001513B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00151420

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 5a0f9b7408ebd997a665b68306ef34464f40117f7524e003a8505042d7b6c1c8
Instruction ID: 6ac051c8a0994b3c2b93109e8a1e8972c044e7d8ada5594cd94820289f1a216d
Opcode Fuzzy Hash: 5a0f9b7408ebd997a665b68306ef34464f40117f7524e003a8505042d7b6c1c8
Instruction Fuzzy Hash: B9317C71604202EFD715EF29C491B69B7A2FF4532AF04826DE82A4F292DB71EC55CBD0

Function 000C4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 000C4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,000C4EDD,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E9C
Part of subcall function 000C4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 000C4EAE
Part of subcall function 000C4E90: FreeLibrary.KERNEL32(00000000,?,?,000C4EDD,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4EFD

Part of subcall function 000C4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00103CDE,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E62
Part of subcall function 000C4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 000C4E74
Part of subcall function 000C4E59: FreeLibrary.KERNEL32(00000000,?,?,00103CDE,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E87

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: c64c41c966566ad2551665c1671b301869ca6e63b9c072a77b934046f1b3675d
Instruction ID: 82070dd278fd2c6fec7ff5b1fd63f1653bbd557ffe39849652b8979407b5d51b
Opcode Fuzzy Hash: c64c41c966566ad2551665c1671b301869ca6e63b9c072a77b934046f1b3675d
Instruction Fuzzy Hash: D511E332610305AADB24FF60DC22FED77A5AF50711F20842EF552AA1D2EFB1AA459790

Function 000F8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 000F8440

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 544b0cd8e59c201a4d4f0d914284f9386aa8299b636b69c2cd36c4c31226f002
Instruction ID: c98f3178f9e28ae50027352d5168cd0601d15c8055f37839926cfd85a56b326c
Opcode Fuzzy Hash: 544b0cd8e59c201a4d4f0d914284f9386aa8299b636b69c2cd36c4c31226f002
Instruction Fuzzy Hash: 5211487590410AAFCB05DF58E9419EE7BF8FF48304F148059F908AB312DB30EA11DBA4

Function 000F5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000F4C7D: RtlAllocateHeap.NTDLL(00000008,000C1129,00000000,?,000F2E29,00000001,00000364,?,?,?,000EF2DE,000F3863,00191444,?,000DFDF5,?), ref: 000F4CBE

_free.LIBCMT ref: 000F506C

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 74932b80cf2b035b94cf5a32ffa1ad7aca3a2fb769e3c7e1623b3d332a376451
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 91014E722047095BE3318F55DC459AAFBECFB85370F25051DE794836C1EA706805C7B4

Function 001529BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,001514B5,?), ref: 00152A01

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 16c81e9157e14b3c55308f4e67b19ebede5e062031600c32f3383f402aaea28c
Instruction ID: f595e148f04eca276a39129245631c81814c0cd40d35e38653bfd27dbbfff549
Opcode Fuzzy Hash: 16c81e9157e14b3c55308f4e67b19ebede5e062031600c32f3383f402aaea28c
Instruction Fuzzy Hash: DA019237300651DFE3258A2CC454B227792EB9631AF298468C4678F651D732EC46C790

Function 000EE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: f581a561ca329b3a9bce4854d4037c4476bd8fa2bf7fe93f7032546f97956e43
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 81F0F432511A9C9ECA313A6BDC05BEA33989F523B4F100716FA20B35D3DB70D80196A5

Function 0015149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 001514EB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 855be57689b5bdfe066a8c4858327ae8dde3e56a67d14a7a2c8769ae96c4eb67
Instruction ID: 12c3bc033c6f8476d5b6457b08b050b7b6b42343e02410722f81734f9c6a717b
Opcode Fuzzy Hash: 855be57689b5bdfe066a8c4858327ae8dde3e56a67d14a7a2c8769ae96c4eb67
Instruction Fuzzy Hash: 2A01B135208751EF9321CF69C440926BB95EB95325754806DEC5A8F702D732DD86C780

Function 000F4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,000C1129,00000000,?,000F2E29,00000001,00000364,?,?,?,000EF2DE,000F3863,00191444,?,000DFDF5,?), ref: 000F4CBE

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a3571135a1dd7114326b77d20622eaf5a8b80f74dd9b12620206994daa30f7b5
Instruction ID: 5ab14480cdc7a3ee8c19fb5a5a7ece19f40ab6e6c73c5a50b06646613d6a9d79
Opcode Fuzzy Hash: a3571135a1dd7114326b77d20622eaf5a8b80f74dd9b12620206994daa30f7b5
Instruction Fuzzy Hash: 6FF0BB3150226C6ADBA15F629C05B7B37D8BF41761B145125BF19A7A81CA30D80065D0

Function 000F3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6,?,000C1129), ref: 000F3852

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dcbf13906800e252306d2841bf747753c0ac3232d4fe320570f822de82ff811f
Instruction ID: 83955f0597e0c6aab9be7531c696f51e6a4da2896ce8deffb275a942b3965516
Opcode Fuzzy Hash: dcbf13906800e252306d2841bf747753c0ac3232d4fe320570f822de82ff811f
Instruction Fuzzy Hash: 5CE0E53110036DAAD6712A779D01BFA36C8AB42BF0F090021BE04A6E81DF19DE03A1E0

Function 000C4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4F6D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 40b4ded9df539fc131fac9c3a57e49c25021a966966fcb8cbda6cf08cbdf73d1
Instruction ID: 9fe2efde7b695aad62b140791c359ee0754f92812b66b0fa0f9f41747cccc1f0
Opcode Fuzzy Hash: 40b4ded9df539fc131fac9c3a57e49c25021a966966fcb8cbda6cf08cbdf73d1
Instruction Fuzzy Hash: 5EF03971105752CFDB349F64D4A0E6ABBE4BF14329320897EE1EA82621CB319885DF50

Function 00152A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00152A66

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 55601fda02ff09615281772897f97574462f25665a50d52cbdc349caef2212ff
Instruction ID: 98325035840a1135c2744baa49719cfd6adcfea0b5b3b1b6c35500fb2426e304
Opcode Fuzzy Hash: 55601fda02ff09615281772897f97574462f25665a50d52cbdc349caef2212ff
Instruction Fuzzy Hash: ACE04F36354226EBC718EA30EC808FA735CEB65396B104536EC26CB540DB349AA986E0

Function 000C2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000C2DC4

Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 02d332c0da421b48bf0fb589910e83e5456f9ad59d0677da3677dd8a1573942f
Instruction ID: 8eeb0c6cbfad30ec64d43f42d9a94b49a7cbd55a8abe81d4788ed978a1c7198f
Opcode Fuzzy Hash: 02d332c0da421b48bf0fb589910e83e5456f9ad59d0677da3677dd8a1573942f
Instruction Fuzzy Hash: 37E0C272A002246BCB20E7989C06FEA77EDDFC8790F0400B5FD09E7248DAA4ADC48690

Function 000C2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000C3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 000C3908

Part of subcall function 000CD730: GetInputState.USER32 ref: 000CD807

SetCurrentDirectoryW.KERNEL32(?), ref: 000C2B6B

Part of subcall function 000C30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 000C314E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 582133e8222730336f130ac35b3ed141bcfeab9c211d898b2a3ad3f580d01e1e
Instruction ID: be1fc837e0f7f3d01c25b24c65a8b706fe8941f4676c93dc0b1eb71c3887bf43
Opcode Fuzzy Hash: 582133e8222730336f130ac35b3ed141bcfeab9c211d898b2a3ad3f580d01e1e
Instruction Fuzzy Hash: 26E0862230434516CA04BB74A856FFDB7599BD5351F40553EF142471A3DF2489CA4251

Function 00123D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00123D18

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 790e1a383e5ed5e6e3e7b1a326cc57a2ee349ac9b2ca51f119404041c170221f
Instruction ID: 7b8231cd77a3c1025fc7e7216e5a1b1074b5d04707d62a05fe334804196dcaf6
Opcode Fuzzy Hash: 790e1a383e5ed5e6e3e7b1a326cc57a2ee349ac9b2ca51f119404041c170221f
Instruction Fuzzy Hash: 50D08CF06A0308BEFB0087718C0BEBB339CC316E82F004BA47E02DA9C1E9A0DE080170

Function 0010039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00100704,?,?,00000000,?,00100704,00000000,0000000C), ref: 001003B7

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b361be10b0e00002bae87d68e464da797d7746894510e8ec70cf6ac496f1c008
Instruction ID: 2e89f02ddee3c7705cc33bc6bc8e645745fc4774387fc3c987b322dc5e6a8ec4
Opcode Fuzzy Hash: b361be10b0e00002bae87d68e464da797d7746894510e8ec70cf6ac496f1c008
Instruction Fuzzy Hash: 8CD06C3204020DFFDF029F84DD46EDA3BAAFB48714F014000BE185A020C732E861AB90

Function 000C1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 000C1CBC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: b09a23bbbe24cd81e790c24804f3d509a3bf5a94f209aa1b9b9955293ddc6caa
Instruction ID: 6786e4fb22ba81df57cf4a6fd9f2fd0cfbc65183e2e0fd3c039f356b7d2295b6
Opcode Fuzzy Hash: b09a23bbbe24cd81e790c24804f3d509a3bf5a94f209aa1b9b9955293ddc6caa
Instruction Fuzzy Hash: 6EC0483A380306AEF2148B90AC4AF507764A348B11F448002F619A99E392B228A0EA90

Non-executed Functions

Function 00159576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0015961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0015965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0015969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001596C9
SendMessageW.USER32 ref: 001596F2
GetKeyState.USER32(00000011), ref: 0015978B
GetKeyState.USER32(00000009), ref: 00159798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 001597AE
GetKeyState.USER32(00000010), ref: 001597B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001597E9
SendMessageW.USER32 ref: 00159810
SendMessageW.USER32(?,00001030,?,00157E95), ref: 00159918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0015992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00159941
SetCapture.USER32(?), ref: 0015994A
ClientToScreen.USER32(?,?), ref: 001599AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 001599BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001599D6
ReleaseCapture.USER32 ref: 001599E1
GetCursorPos.USER32(?), ref: 00159A19
ScreenToClient.USER32(?,?), ref: 00159A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00159A80
SendMessageW.USER32 ref: 00159AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00159AEB
SendMessageW.USER32 ref: 00159B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00159B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00159B4A
GetCursorPos.USER32(?), ref: 00159B68
ScreenToClient.USER32(?,?), ref: 00159B75
GetParent.USER32(?), ref: 00159B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00159BFA
SendMessageW.USER32 ref: 00159C2B
ClientToScreen.USER32(?,?), ref: 00159C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00159CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00159CDE
SendMessageW.USER32 ref: 00159D01
ClientToScreen.USER32(?,?), ref: 00159D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00159D82

Part of subcall function 000D9944: GetWindowLongW.USER32(?,000000EB), ref: 000D9952

GetWindowLongW.USER32(?,000000F0), ref: 00159E05

Strings

@GUI_DRAGID, xrefs: 0015997D
F, xrefs: 00159D07

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 070ad3fa64374542d34f7c9df8966734506f17b141a29ea78ac9a90b8da5c5f0
Instruction ID: 5d1c605c6e40d2b424feef0e14b729146206454f46baa6e0fa3d669961f9f85b
Opcode Fuzzy Hash: 070ad3fa64374542d34f7c9df8966734506f17b141a29ea78ac9a90b8da5c5f0
Instruction Fuzzy Hash: 8A429C74204301EFDB25CF24CD44AAABBE5FF48315F10061EF9698B6A1D731A998DF92

Function 00154873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 001548F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00154908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00154927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0015494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0015495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0015497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 001549AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 001549D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00154A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00154A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00154A7E
IsMenu.USER32(?), ref: 00154A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00154AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00154B20
GetWindowLongW.USER32(?,000000F0), ref: 00154B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00154BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00154C82
wsprintfW.USER32 ref: 00154CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00154CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00154CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00154D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00154D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00154D5A

Strings

%d/%02d/%02d, xrefs: 00154CA8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 282e94e46a45b86cfc0a318afe0405932bc2b7ab74796b254e321af16ef7c082
Instruction ID: f6dbd103fef0e1047808425eb319563f75f11c78759474e50ea748510d39a147
Opcode Fuzzy Hash: 282e94e46a45b86cfc0a318afe0405932bc2b7ab74796b254e321af16ef7c082
Instruction Fuzzy Hash: F712CF71600314EFEB258F68CC49FEE7BB8EB45719F10411AF926DE2A1DB749A84CB50

Function 000DF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 000DF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0011F474
IsIconic.USER32(00000000), ref: 0011F47D
ShowWindow.USER32(00000000,00000009), ref: 0011F48A
SetForegroundWindow.USER32(00000000), ref: 0011F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0011F4AA
GetCurrentThreadId.KERNEL32 ref: 0011F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0011F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0011F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0011F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0011F4DE
SetForegroundWindow.USER32(00000000), ref: 0011F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0011F4F6
keybd_event.USER32(00000012,00000000), ref: 0011F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0011F50B
keybd_event.USER32(00000012,00000000), ref: 0011F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0011F519
keybd_event.USER32(00000012,00000000), ref: 0011F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0011F528
keybd_event.USER32(00000012,00000000), ref: 0011F52D
SetForegroundWindow.USER32(00000000), ref: 0011F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0011F557

Strings

Shell_TrayWnd, xrefs: 0011F46F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: fa67de7864ebb8172223bfe342b5ca3bb656711e73e407d3f3b4fb43e5ade5c5
Instruction ID: b6074ddf2ee5d394851224cb2c93f1173152f61514ba9bf3f6673b8149705daf
Opcode Fuzzy Hash: fa67de7864ebb8172223bfe342b5ca3bb656711e73e407d3f3b4fb43e5ade5c5
Instruction Fuzzy Hash: 6D318D71B40318BEEB246FB55C4AFBF7E6DEB44B51F100069FA00EA1D1D7B05981AAA0

Function 00121201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 001216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0012170D
Part of subcall function 001216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0012173A
Part of subcall function 001216C3: GetLastError.KERNEL32 ref: 0012174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00121286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 001212A8
CloseHandle.KERNEL32(?), ref: 001212B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 001212D1
GetProcessWindowStation.USER32 ref: 001212EA
SetProcessWindowStation.USER32(00000000), ref: 001212F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00121310

Part of subcall function 001210BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,001211FC), ref: 001210D4
Part of subcall function 001210BF: CloseHandle.KERNEL32(?,?,001211FC), ref: 001210E9

Strings

, xrefs: 0012125A
winsta0, xrefs: 001212CC
default, xrefs: 0012130B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: add01d6c5b772c077d30617231e156a2e6b367d21e268128e4f7e0d2890b0ff2
Instruction ID: a5ec81c4a355613b55f8165e9c946ab9614473473f32ef94565e00f48ed500f4
Opcode Fuzzy Hash: add01d6c5b772c077d30617231e156a2e6b367d21e268128e4f7e0d2890b0ff2
Instruction Fuzzy Hash: C481AD71900359BFDF20EFA4EC49BEE7BB9EF14700F144129F915A62A0D7708AA4CB60

Function 00120B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00121114
Part of subcall function 001210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121120
Part of subcall function 001210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 0012112F
Part of subcall function 001210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121136
Part of subcall function 001210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0012114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00120BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00120C00
GetLengthSid.ADVAPI32(?), ref: 00120C17
GetAce.ADVAPI32(?,00000000,?), ref: 00120C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00120C6D
GetLengthSid.ADVAPI32(?), ref: 00120C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00120C8C
HeapAlloc.KERNEL32(00000000), ref: 00120C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00120CB4
CopySid.ADVAPI32(00000000), ref: 00120CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00120CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00120D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00120D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120D45
HeapFree.KERNEL32(00000000), ref: 00120D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120D55
HeapFree.KERNEL32(00000000), ref: 00120D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120D65
HeapFree.KERNEL32(00000000), ref: 00120D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00120D78
HeapFree.KERNEL32(00000000), ref: 00120D7F

Part of subcall function 00121193: GetProcessHeap.KERNEL32(00000008,00120BB1,?,00000000,?,00120BB1,?), ref: 001211A1
Part of subcall function 00121193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00120BB1,?), ref: 001211A8
Part of subcall function 00121193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00120BB1,?), ref: 001211B7

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: e32eff31de3325c9b337da8195d85bfafbac9e399e12f8f8e9c326a62cce97ee
Instruction ID: 4c170a9acf8b738c55cc20a3bd803a9d51d08bcdd59c538f5d8ee7bb87b00b32
Opcode Fuzzy Hash: e32eff31de3325c9b337da8195d85bfafbac9e399e12f8f8e9c326a62cce97ee
Instruction Fuzzy Hash: ED716A7590131AEFDF11DFE4EC44BAEBBB8EF08311F044215F914AA292D771AA55CBA0

Function 0013EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0015CC08), ref: 0013EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0013EB37
GetClipboardData.USER32(0000000D), ref: 0013EB43
CloseClipboard.USER32 ref: 0013EB4F
GlobalLock.KERNEL32(00000000), ref: 0013EB87
CloseClipboard.USER32 ref: 0013EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0013EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0013EBC9
GetClipboardData.USER32(00000001), ref: 0013EBD1
GlobalLock.KERNEL32(00000000), ref: 0013EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0013EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0013EC38
GetClipboardData.USER32(0000000F), ref: 0013EC44
GlobalLock.KERNEL32(00000000), ref: 0013EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0013EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0013EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0013ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0013ECF3
CountClipboardFormats.USER32 ref: 0013ED14
CloseClipboard.USER32 ref: 0013ED59

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 20b53fc997128f997d98f04248fc179e4e04ddee1395c0a7ee1dac4b2776ecd8
Instruction ID: 64c18a18df515a6f6d969ca9bba311ca4801362ac9f3bb187aacb7dff6a02174
Opcode Fuzzy Hash: 20b53fc997128f997d98f04248fc179e4e04ddee1395c0a7ee1dac4b2776ecd8
Instruction Fuzzy Hash: EB61AB34204301AFD310EF64D899F6AB7E4EF84714F14455DF4569B2E2CB71EA85CBA2

Function 0013698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 001369BE
FindClose.KERNEL32(00000000), ref: 00136A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00136A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00136A75

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00136AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00136ADF

Strings

%03d, xrefs: 00136DA2
%02d, xrefs: 00136C00, 00136C0A, 00136C5A, 00136CAA, 00136CFA, 00136D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00136B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00136B32
%4d, xrefs: 00136BB1

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 61f4dde533c6329b2f8cf03d7b5a7faaa2705fe5aac4350190f344e0bb9cad0c
Instruction ID: ae95291748b613a023416962041e84ca580752b6d6bfca8e34f67b561b9f8e14
Opcode Fuzzy Hash: 61f4dde533c6329b2f8cf03d7b5a7faaa2705fe5aac4350190f344e0bb9cad0c
Instruction Fuzzy Hash: 43D14171508340AFC714EBA4C886EAFB7ECAF88704F44491DF589D7192EB74DA49CB62

Function 00139642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00139663
GetFileAttributesW.KERNEL32(?), ref: 001396A1
SetFileAttributesW.KERNEL32(?,?), ref: 001396BB
FindNextFileW.KERNEL32(00000000,?), ref: 001396D3
FindClose.KERNEL32(00000000), ref: 001396DE
FindFirstFileW.KERNEL32(*.*,?), ref: 001396FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0013974A
SetCurrentDirectoryW.KERNEL32(00186B7C), ref: 00139768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00139772
FindClose.KERNEL32(00000000), ref: 0013977F
FindClose.KERNEL32(00000000), ref: 0013978F

Strings

*.*, xrefs: 001396F5

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 22cac37931d8a3bd398360795bb55ed5066e73643b7fbc3c96c03bd8f0185c52
Instruction ID: ca328e2ce59952a3fe0ba1af424e2579a1362189401a65fd945e64ebeb9ef132
Opcode Fuzzy Hash: 22cac37931d8a3bd398360795bb55ed5066e73643b7fbc3c96c03bd8f0185c52
Instruction Fuzzy Hash: 1631F13264131AAFDF14AFB4DC49ADE77ACAF09322F144055F915E60E0EBB4DE848E90

Function 0013979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 001397BE
FindNextFileW.KERNEL32(00000000,?), ref: 00139819
FindClose.KERNEL32(00000000), ref: 00139824
FindFirstFileW.KERNEL32(*.*,?), ref: 00139840
SetCurrentDirectoryW.KERNEL32(?), ref: 00139890
SetCurrentDirectoryW.KERNEL32(00186B7C), ref: 001398AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 001398B8
FindClose.KERNEL32(00000000), ref: 001398C5
FindClose.KERNEL32(00000000), ref: 001398D5

Part of subcall function 0012DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0012DB00

Strings

*.*, xrefs: 0013983B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 5eb7a3c5a5a6d2922a9190e7b573a9ce56da2599c7278b2dcfbfce378315a26a
Instruction ID: c4c14ed6f4700d1a6af0bbb87d468a715dab0e2e164c30e89f66f9bf9a11c78f
Opcode Fuzzy Hash: 5eb7a3c5a5a6d2922a9190e7b573a9ce56da2599c7278b2dcfbfce378315a26a
Instruction Fuzzy Hash: 2D31D23250035EAEDF10EFB4EC48ADE77ACAF46325F1441A5E950A60A1DBB4DE84CF60

Function 0014BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0014C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0014B6AE,?,?), ref: 0014C9B5
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014C9F1
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA68
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0014BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0014BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0014BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0014C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0014C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0014C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0014C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0014C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0014C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0014C382
RegCloseKey.ADVAPI32(00000000), ref: 0014C38F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 9f95d30972b28e598914a18e7f03f383a4b140b9f8abe214201b8d790dc07c68
Instruction ID: cd0f45c9572e17e7d7f7db2bce3539f81c6be2cbd2c99906dd394873f8886232
Opcode Fuzzy Hash: 9f95d30972b28e598914a18e7f03f383a4b140b9f8abe214201b8d790dc07c68
Instruction Fuzzy Hash: 2B023C716042009FD754DF28C895E2ABBE5EF89318F18C49DF84ACB2A2DB31ED45CB91

Function 00138195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00138257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00138267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00138273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00138310
SetCurrentDirectoryW.KERNEL32(?), ref: 00138324
SetCurrentDirectoryW.KERNEL32(?), ref: 00138356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0013838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00138395

Strings

*.*, xrefs: 0013839B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 695f708c618102c9fefa003003ea0e049d855c4aec3fb4e3b2f2206d6731c6a2
Instruction ID: 85d21375b86c2f073419f34e2cc51610a4901858191ae54d321f1c4cf9de86ca
Opcode Fuzzy Hash: 695f708c618102c9fefa003003ea0e049d855c4aec3fb4e3b2f2206d6731c6a2
Instruction Fuzzy Hash: 226169725043459FCB10EF60C841EAEB3E8FF89314F04892EF98997252DB35E949CB92

Function 0012D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000C3A97,?,?,000C2E7F,?,?,?,00000000), ref: 000C3AC2

Part of subcall function 0012E199: GetFileAttributesW.KERNEL32(?,0012CF95), ref: 0012E19A

FindFirstFileW.KERNEL32(?,?), ref: 0012D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0012D1DD
MoveFileW.KERNEL32(?,?), ref: 0012D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0012D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0012D237

Part of subcall function 0012D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0012D21C,?,?), ref: 0012D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0012D253
FindClose.KERNEL32(00000000), ref: 0012D264

Strings

\*.*, xrefs: 0012D0CD, 0012D0D6, 0012D0EB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 32ffe8b08d6dd1e1724e1bb654d641ddf4f5b24a7014128e8be874ef26f8b04b
Instruction ID: 6f7c3366f8023294738cedc79e3bf108b9ddda3f654fbfb08451f2ee71fd5cbf
Opcode Fuzzy Hash: 32ffe8b08d6dd1e1724e1bb654d641ddf4f5b24a7014128e8be874ef26f8b04b
Instruction Fuzzy Hash: 6E615C3190125D9FCF05EBA0EA92EEDB7B5AF15300F608169E40277192EB30AF19CB61

Function 0013ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0013ED91
EmptyClipboard.USER32 ref: 0013ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0013EDAC
CloseClipboard.USER32 ref: 0013EEA3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 4088ad22b00fe0ec347332d481df1eb305824750531a8d29ae728ec434f22122
Instruction ID: 45ddf7d4db2b3db4d5dd696e289fb0e351c12449a1f439e0f4ed8fc0e9369192
Opcode Fuzzy Hash: 4088ad22b00fe0ec347332d481df1eb305824750531a8d29ae728ec434f22122
Instruction Fuzzy Hash: 5A416A35604711EFE710DF15D888F5ABBE5EF44329F1480A9E4198FAA2C735ED82CB90

Function 0012E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 001216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0012170D
Part of subcall function 001216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0012173A
Part of subcall function 001216C3: GetLastError.KERNEL32 ref: 0012174A

ExitWindowsEx.USER32(?,00000000), ref: 0012E932

Strings

@, xrefs: 0012E925
, xrefs: 0012E95C
SeShutdownPrivilege, xrefs: 0012E902
, xrefs: 0012E920

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 83d9d6c01d07755ec08e1bc4ca280104463bb34e2baf8417bb0ac3c54b601a94
Instruction ID: a89eb6d170ddfca038460e8f77f5ec637d4abc1daa477d6aa957b370952dc7ff
Opcode Fuzzy Hash: 83d9d6c01d07755ec08e1bc4ca280104463bb34e2baf8417bb0ac3c54b601a94
Instruction Fuzzy Hash: 9801D672A10331AFEF5466B8BC8ABBF729CA724759F150423F902E61D1E7A05CE4C6D4

Function 00141204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00141276
WSAGetLastError.WSOCK32 ref: 00141283
bind.WSOCK32(00000000,?,00000010), ref: 001412BA
WSAGetLastError.WSOCK32 ref: 001412C5
closesocket.WSOCK32(00000000), ref: 001412F4
listen.WSOCK32(00000000,00000005), ref: 00141303
WSAGetLastError.WSOCK32 ref: 0014130D
closesocket.WSOCK32(00000000), ref: 0014133C

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 0635fe02fc3b3cbfec56ee985ee150a4c2d7245d7782b03c3ca484fe120e073c
Instruction ID: 328f79ed3a120bed43919b1aed8ea51e3b189a4dcc9f1ed55a3d42eb6d1d934c
Opcode Fuzzy Hash: 0635fe02fc3b3cbfec56ee985ee150a4c2d7245d7782b03c3ca484fe120e073c
Instruction Fuzzy Hash: 9D414E31600200AFD714DF64C485F69BBE6BF46318F288198E8569F2A6C771EDC2CBE1

Function 0012D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000C3A97,?,?,000C2E7F,?,?,?,00000000), ref: 000C3AC2

Part of subcall function 0012E199: GetFileAttributesW.KERNEL32(?,0012CF95), ref: 0012E19A

FindFirstFileW.KERNEL32(?,?), ref: 0012D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0012D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0012D481
FindClose.KERNEL32(00000000), ref: 0012D498
FindClose.KERNEL32(00000000), ref: 0012D4A1

Strings

\*.*, xrefs: 0012D3F2

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 668091ce3aeec634f25fcda9c63b3eb8dfb89ee54bce9c45097bc45a7a41cdb7
Instruction ID: ca41c5c4da0b3f02345ba387cd78b02c9f1eee507c027a6e337c0c728e175678
Opcode Fuzzy Hash: 668091ce3aeec634f25fcda9c63b3eb8dfb89ee54bce9c45097bc45a7a41cdb7
Instruction Fuzzy Hash: 41316F310083959FC204EF64E855DEF77A8AF96314F444A1DF4D153192EB30AA19CB63

Function 000FE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 000FE645

Strings

1#IND, xrefs: 000FF83D
1#QNAN, xrefs: 000FF84B
1#SNAN, xrefs: 000FF844
1#INF, xrefs: 000FF852

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 34d9f2d45f9533c6b358f12e7917ce322b9070a1e395aa0335b0c3b43628a890
Instruction ID: facc1f046acf5843595898a69fe43feaab5f4c898d87d0ecd95efaec6ec0be1b
Opcode Fuzzy Hash: 34d9f2d45f9533c6b358f12e7917ce322b9070a1e395aa0335b0c3b43628a890
Instruction Fuzzy Hash: A4C25872E086298FDB64CE28DD407FAB7B5EB44304F1441EADA0DE7651E778AE819F40

Function 0013648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001364DC
CoInitialize.OLE32(00000000), ref: 00136639
CoCreateInstance.OLE32(0015FCF8,00000000,00000001,0015FB68,?), ref: 00136650
CoUninitialize.OLE32 ref: 001368D4

Strings

.lnk, xrefs: 001364BA, 00136524, 001365E0

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 801bd954eea960ea59f4d5cbb0c3c454e8fa1be0778ddd3a915dce8fddca16ca
Instruction ID: ce5be1620e316509957a47a630d095e63d83f84d983e290b7717e0c6659eb2b3
Opcode Fuzzy Hash: 801bd954eea960ea59f4d5cbb0c3c454e8fa1be0778ddd3a915dce8fddca16ca
Instruction Fuzzy Hash: 2BD12A71508301AFD314EF24C881EABB7E8EF99704F50896DF5558B292DB71E906CB92

Function 001422DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 001422E8

Part of subcall function 0013E4EC: GetWindowRect.USER32(?,?), ref: 0013E504

GetDesktopWindow.USER32 ref: 00142312
GetWindowRect.USER32(00000000), ref: 00142319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00142355
GetCursorPos.USER32(?), ref: 00142381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 001423DF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: f6366ac588911429df39b51fd7630628a93d4a9743f8cf4112f8f4fb1ba15594
Instruction ID: 34249d109f7c249f7585bf60807f20b4b3efabb2c542f6a6f981bb03cbf00d97
Opcode Fuzzy Hash: f6366ac588911429df39b51fd7630628a93d4a9743f8cf4112f8f4fb1ba15594
Instruction Fuzzy Hash: B131DE72504315AFCB20DF54D849B9BBBE9FF88314F400A19F9859B191DB74EA88CBD2

Function 00139B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00139B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00139C8B

Part of subcall function 00133874: GetInputState.USER32 ref: 001338CB
Part of subcall function 00133874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00133966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00139BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00139C75

Strings

*.*, xrefs: 00139B5D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: d8d452bc164fc491316ca2a956d7f5e1a1787628be7a92dc82682d5639fb22f9
Instruction ID: 84e00c77be1a4f644101be8d447ee1ff954f64f310b71f49594754ac97c27627
Opcode Fuzzy Hash: d8d452bc164fc491316ca2a956d7f5e1a1787628be7a92dc82682d5639fb22f9
Instruction Fuzzy Hash: 1F41407190420A9FDF15DFA4C989EEEBBB8EF05311F244159E815A7191EB709E84CFA0

Function 000D997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 000D9A4E
GetSysColor.USER32(0000000F), ref: 000D9B23
SetBkColor.GDI32(?,00000000), ref: 000D9B36

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 48c011ad5ecc2b97f36ea975d01babe8c9866c361953640fca2d578ea7dfac06
Instruction ID: c3ab8990297ea0961d8dc42fe186d89394f93761fe7e66a009944c2a2610ac99
Opcode Fuzzy Hash: 48c011ad5ecc2b97f36ea975d01babe8c9866c361953640fca2d578ea7dfac06
Instruction Fuzzy Hash: E9A1F771208604FEE739AA2C8C59DBF36ADDB42350F15021BF512DABD1DB259D81D2B3

Function 00141806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0014304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0014307A
Part of subcall function 0014304E: _wcslen.LIBCMT ref: 0014309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0014185D
WSAGetLastError.WSOCK32 ref: 00141884
bind.WSOCK32(00000000,?,00000010), ref: 001418DB
WSAGetLastError.WSOCK32 ref: 001418E6
closesocket.WSOCK32(00000000), ref: 00141915

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: b3b8ac8a21a4c504985d2bc7be117bcd5ae13ecacc425704f2a2659970d230e6
Instruction ID: d743a702904d5f1eac80f92ddf855cca5d642b8fb4d5128690956551c9e690f7
Opcode Fuzzy Hash: b3b8ac8a21a4c504985d2bc7be117bcd5ae13ecacc425704f2a2659970d230e6
Instruction Fuzzy Hash: DB518275A00210AFEB10AF24C886F6E77E5AF44718F58845CF91A5F3D3D771AD828BA1

Function 00151C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00151CC0
IsWindowEnabled.USER32 ref: 00151CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00151CDB
IsIconic.USER32 ref: 00151CE9
IsZoomed.USER32 ref: 00151CF7

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: ed64852021daafa74163d00628eb550e04c49d59935fe7e2d458403797f96599
Instruction ID: 7eaf7446c71c640527b3a4b6254985b7820eff138de8e003c54c855acc3a8c2c
Opcode Fuzzy Hash: ed64852021daafa74163d00628eb550e04c49d59935fe7e2d458403797f96599
Instruction Fuzzy Hash: 59219131740211EFD7228F1AC884F6A7BA5AF95326B59806CEC5A8F351D772EC46CB90

Function 000C8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 000C843C
VUUU, xrefs: 000C83FA
VUUU, xrefs: 00105DF0
VUUU, xrefs: 000C83E8
ERCP, xrefs: 000C813C

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 0ac5fca57935855bef588b8e1e422e2c109edec0d239854d71dd5114d4a01200
Instruction ID: bcb9f5da3d53189d31ad1bfc75a8ed28ccc248fb836e8312290ebb979463bdca
Opcode Fuzzy Hash: 0ac5fca57935855bef588b8e1e422e2c109edec0d239854d71dd5114d4a01200
Instruction Fuzzy Hash: E6A28470E0061ACBDF34CF58C944BAEB7B2BF54310F2481AAE855A7285EBB49D91CF54

Function 0014A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0014A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0014A6BA

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0014A79C
CloseHandle.KERNEL32(00000000), ref: 0014A7AB

Part of subcall function 000DCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00103303,?), ref: 000DCE8A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 90d2ba941e1719c967bc7180df4b841be250d967fad4aeb9baeefe0cf6c91f9c
Instruction ID: e16b1ae372f47376193db9afcd8ea7ffa8e1e89b6d6fe7ad8de9fb20bd11fbfc
Opcode Fuzzy Hash: 90d2ba941e1719c967bc7180df4b841be250d967fad4aeb9baeefe0cf6c91f9c
Instruction Fuzzy Hash: 895108715083019FD710DF24C886EAEBBE8FF89754F40491DF59A972A2EB31D905CBA2

Function 0012AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0012AAAC
SetKeyboardState.USER32(00000080), ref: 0012AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0012AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0012AB88

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0db559f4b03878ec7e1a2c6d28bd689e3a5a77039898dc7a9b1ca5d4e7bf34da
Instruction ID: 54da06744b220e1ca42f67a3b4830adb48a13c7bbdabfeab80d90d2aa51dc230
Opcode Fuzzy Hash: 0db559f4b03878ec7e1a2c6d28bd689e3a5a77039898dc7a9b1ca5d4e7bf34da
Instruction Fuzzy Hash: C6314B30A40328AFFF35CB68EC05BFE7BA6AF54310F84421AF581961D0D37599A5C7A2

Function 000FBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000FBB7F

Part of subcall function 000F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0

GetTimeZoneInformation.KERNEL32 ref: 000FBB91
WideCharToMultiByte.KERNEL32(00000000,?,0019121C,000000FF,?,0000003F,?,?), ref: 000FBC09
WideCharToMultiByte.KERNEL32(00000000,?,00191270,000000FF,?,0000003F,?,?,?,0019121C,000000FF,?,0000003F,?,?), ref: 000FBC36

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 90aa526f38ae39ac14c3b668bccdb05885322536b6ca227edbc99cd758e670d4
Instruction ID: b52ce7266dbe96fa00a77154ddad002a8e3adff342dc029dea6753d5e5afef01
Opcode Fuzzy Hash: 90aa526f38ae39ac14c3b668bccdb05885322536b6ca227edbc99cd758e670d4
Instruction Fuzzy Hash: 5131A27090420AEFCB11EF69DC8047EBBF8BF45750724429AE150DBAA1D7709A80EF90

Function 0013CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0013CE89
GetLastError.KERNEL32(?,00000000), ref: 0013CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0013CEFE

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 9f5d1874e3ce7b65695395cc492a0232441eb43523e312183c6b285455f70680
Instruction ID: c6be232bac8370517148c79276cf7bdb498aca5f1b8d4203b6c2f6c7288562ea
Opcode Fuzzy Hash: 9f5d1874e3ce7b65695395cc492a0232441eb43523e312183c6b285455f70680
Instruction Fuzzy Hash: 6A21BAB1500705EFEB20DFA5C948BAABBFCEB40358F10442EE646A6151E770EE448BA0

Function 00128298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 001282AA

Strings

(, xrefs: 001282F0
|, xrefs: 001282DA

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 7a963c470f39a80aa147386761d43a9d922651d154119a165a57d5106070cb31
Instruction ID: de142dacf061b0bcea1a70d23d5400b6179f202124812df7364798c8645f5f2e
Opcode Fuzzy Hash: 7a963c470f39a80aa147386761d43a9d922651d154119a165a57d5106070cb31
Instruction Fuzzy Hash: 78323474A007159FCB28CF19D481AAAB7F0FF48710B15C46EE49ADB3A1EB70E991CB50

Function 00135C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00135CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00135D17
FindClose.KERNEL32(?), ref: 00135D5F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: a32036613fe2f5f696f5f3f6177c6321a4486539b5d6a29ba1f7fc0a69a43f92
Instruction ID: d6588f328656fa5a9ff5216632ccc0ed825dc2bc19ce010cfd1c18eca090a039
Opcode Fuzzy Hash: a32036613fe2f5f696f5f3f6177c6321a4486539b5d6a29ba1f7fc0a69a43f92
Instruction Fuzzy Hash: 19518874604B019FC718CF68C494E9AB7E5FF49324F14855EE99A8B3A2CB30ED45CB91

Function 000F2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 000F271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000F2724
UnhandledExceptionFilter.KERNEL32(?), ref: 000F2731

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2ed8c6f8099ee39833d07d86007028c6d7428354f2c686701a00e6e74d1fa1a6
Instruction ID: 503d0e49cdbd4f5d9859389cdbedd17b651b57b5171377a6f43db7bef4a3651d
Opcode Fuzzy Hash: 2ed8c6f8099ee39833d07d86007028c6d7428354f2c686701a00e6e74d1fa1a6
Instruction Fuzzy Hash: 2F31B47491131CDBCB61EF65DC897D9B7B8AF18310F5041EAE41CA6261E7709F818F45

Function 001351CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 001351DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00135238
SetErrorMode.KERNEL32(00000000), ref: 001352A1

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: a8780a57debadbba4af31378951155e5a176dba3d900d20c5deed2668e0a30b7
Instruction ID: da583d01b93b81c1d22b092f28e4ab961b2920ed3efca2804f5f2d6a22019db5
Opcode Fuzzy Hash: a8780a57debadbba4af31378951155e5a176dba3d900d20c5deed2668e0a30b7
Instruction Fuzzy Hash: B6312F75A00618DFDB00DF54D884FAEBBB5FF49314F448099E8099B352DB71E856CB90

Function 001216C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 000DFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 000E0668
Part of subcall function 000DFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 000E0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0012170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0012173A
GetLastError.KERNEL32 ref: 0012174A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: e744e74b74c45d0513578d013ed8d8a56c0390c08c7516beef962c3ccd9d2c93
Instruction ID: dd6456e5fb9edd36784c2567934c126a314c7690a2b819000fe6adbe30d57025
Opcode Fuzzy Hash: e744e74b74c45d0513578d013ed8d8a56c0390c08c7516beef962c3ccd9d2c93
Instruction Fuzzy Hash: 4F1191B2404305BFD718DF54EC86DABB7BAEB44725B20852EF05657641EB70BC51CA60

Function 0012D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0012D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0012D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0012D650

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: dc30ee7cee2f6e1cc73734792fcc4bf832d1de54d8b1fc552a12676bb6fb3753
Instruction ID: 175c35e730bdfe0af6229cc78e2c436d0b275f9c6f266c8003388e706aa71db5
Opcode Fuzzy Hash: dc30ee7cee2f6e1cc73734792fcc4bf832d1de54d8b1fc552a12676bb6fb3753
Instruction Fuzzy Hash: D4112A75A05328BFDB108F95EC45BAFBBBCEB45B50F108115F914A7290D6704A058BE1

Function 00121663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0012168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 001216A1
FreeSid.ADVAPI32(?), ref: 001216B1

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 76124bd3b3aa1ffe34d436ba771debc7ec2139a71cf29ea34f3be660b1919f2e
Instruction ID: 9755391efd243871cd512cf0776f58ce490adcc57a80c436b7057bc31fb146d8
Opcode Fuzzy Hash: 76124bd3b3aa1ffe34d436ba771debc7ec2139a71cf29ea34f3be660b1919f2e
Instruction Fuzzy Hash: F1F0F475950309FFDB00DFE49C89AAEBBBCFB08605F504565E501E6181E774AA848A90

Function 000E4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F28E9,?,000E4CBE,000F28E9,001888B8,0000000C,000E4E15,000F28E9,00000002,00000000,?,000F28E9), ref: 000E4D09
TerminateProcess.KERNEL32(00000000,?,000E4CBE,000F28E9,001888B8,0000000C,000E4E15,000F28E9,00000002,00000000,?,000F28E9), ref: 000E4D10
ExitProcess.KERNEL32 ref: 000E4D22

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 66f8686cbf4736b9a9c41be0c083c6917ea6fb9b471e8d7654a85c7517337271
Instruction ID: 7de24a0c3dc984b89390039695ef4fcf811715bcdd8066b4b8912559b1620468
Opcode Fuzzy Hash: 66f8686cbf4736b9a9c41be0c083c6917ea6fb9b471e8d7654a85c7517337271
Instruction Fuzzy Hash: B2E0B631005788EFCF51AF55DD09A983F69FF81792B108054FD05DA623CB35DD82DA80

Function 0011D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0011D28C

Strings

X64, xrefs: 0011D2A8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: b3f74d578713cff5cf66f419bd28fa7afd30c0439f0c257ef254a4031173e3f2
Instruction ID: 10607fe7b41f377026fca243f8ce891669d7aba2b04a70328e63fd852b3f4a07
Opcode Fuzzy Hash: b3f74d578713cff5cf66f419bd28fa7afd30c0439f0c257ef254a4031173e3f2
Instruction Fuzzy Hash: AFD0C9B480121DEECF94CB90EC88DDDB7BCBB04305F100152F106A2140D77495888F20

Function 000ECAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: d18c819ce543c4553193f1225d589858fb06fe27032c3b3b226e889b80d46367
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 48020D71E012599FEF14CFA9C880AADFBF1EF48314F25416AD919F7384D731A9428B94

Function 001368EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00136918
FindClose.KERNEL32(00000000), ref: 00136961

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f30a49bae1391b7428c09ebe100717a7bcd02561846f0dc9fa7134befb3349fd
Instruction ID: 703e1f863f072150b11493b37a1c503e39af75cc562169807cc7e8405bd257ce
Opcode Fuzzy Hash: f30a49bae1391b7428c09ebe100717a7bcd02561846f0dc9fa7134befb3349fd
Instruction Fuzzy Hash: 02117C31604600AFD710DF29D484F1ABBE5EF85329F15C6ADE4699F6A2C730EC46CB91

Function 001337B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00144891,?,?,00000035,?), ref: 001337E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00144891,?,?,00000035,?), ref: 001337F4

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 33706c063f0ec429bed9d9da7adf4fb2aaac7fc2035214f4b8ead52e42825a9d
Instruction ID: bdd302aa19936d476591579ccafcd3cbe5b466602637b4926f352a6ce12977cd
Opcode Fuzzy Hash: 33706c063f0ec429bed9d9da7adf4fb2aaac7fc2035214f4b8ead52e42825a9d
Instruction Fuzzy Hash: 13F0E5B06043296AE72017668C4DFEB3AAEEFC4761F000165F519D2691DA609944C7F0

Function 0012B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0012B25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 0012B270

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 6c1696db836a9d3458c763f15b59b799c60b0132ef55df125931a3a6008623c0
Instruction ID: 4c2b865533df043d283452ff297b6f8029bb191b6ab6b04389a22c32e88b160b
Opcode Fuzzy Hash: 6c1696db836a9d3458c763f15b59b799c60b0132ef55df125931a3a6008623c0
Instruction Fuzzy Hash: 87F01D7190438EEFDB059FA0D805BAE7FB4FF08305F008009F965A9192D3799651DF94

Function 001210BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,001211FC), ref: 001210D4
CloseHandle.KERNEL32(?,?,001211FC), ref: 001210E9

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 6eecf4bac3d4e8192af08c15dd4890a1ca6a053b36e74dfd0c1c1a101f598826
Instruction ID: dceaa8d01bf5b5fc6d5ed2aa3b99623eb69282d3441e4142f1ed522b2b7e2c56
Opcode Fuzzy Hash: 6eecf4bac3d4e8192af08c15dd4890a1ca6a053b36e74dfd0c1c1a101f598826
Instruction Fuzzy Hash: 64E04F32004711EEE7252B51FC05EB377A9EB04311B10C82EF4A6844B2DB626CE0DB60

Function 000CCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00110C40

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 9470543efa240a50d9e3a8acdd808dc783e95ba970595730baaf24c747104324
Instruction ID: 9979707c0b50a7abf1641d50c85473d600861e4d040bd5c92c532e790d046c47
Opcode Fuzzy Hash: 9470543efa240a50d9e3a8acdd808dc783e95ba970595730baaf24c747104324
Instruction Fuzzy Hash: 66327E74900218DBEF18DF94D881FEDB7B5BF09304F14406DE80AAB292D775AE86CB61

Function 000F676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,000F6766,?,?,00000008,?,?,000FFEFE,00000000), ref: 000F6998

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3d38beff9b730ad736290ed9ddfe32c8526d361d6fc7438ce93ee7d1cde36725
Instruction ID: 895153ecf58358ce0267c247208f493558a8d0cf2063f83394a9e3ce3737edc8
Opcode Fuzzy Hash: 3d38beff9b730ad736290ed9ddfe32c8526d361d6fc7438ce93ee7d1cde36725
Instruction Fuzzy Hash: BEB16C31610608DFD755CF28C486B647BE0FF45364F29865CE99ACF6A2C736E982DB40

Function 000DB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0011851F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2df3c592bf445074fe3cd051023d91f9f603b7fd656f093ed65bd13792bc200a
Instruction ID: e4f8145430d1d2876609337952a3140a967ae97fae00ba0bd1c44ae1e3f2fbc7
Opcode Fuzzy Hash: 2df3c592bf445074fe3cd051023d91f9f603b7fd656f093ed65bd13792bc200a
Instruction Fuzzy Hash: F7124175900229DBDB64CF58C881AEEB7F5FF48710F15816AE849EB255DB309E81CBA0

Function 0013EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0013EABD

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: b6061960566172e262e5adcca9175863928d346bfde5d985963917e142937582
Instruction ID: 1dd19c41904bc87e2d50f6432a8098db728ad200409080f89841ac4314d389d7
Opcode Fuzzy Hash: b6061960566172e262e5adcca9175863928d346bfde5d985963917e142937582
Instruction Fuzzy Hash: B2E04F312003059FD710EF59D805E9AF7E9AF98760F00842AFC49CB391DB70E8418B90

Function 000E09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,000E03EE), ref: 000E09DA

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 03391f66fb04785be65405be740459772f58e877bccce36d50f0432b68ca1e3a
Instruction ID: dcf4ef48895afd9597ad5215be1ea7a8f1ab6bdb81cc765ab5c9fb2bc9d243ec
Opcode Fuzzy Hash: 03391f66fb04785be65405be740459772f58e877bccce36d50f0432b68ca1e3a
Instruction Fuzzy Hash:

Function 000E781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 000E798B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 09da0e2873799e4f8b458868389a39aa8fd1336a06e8cfb83cf2f498919d77fb
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 2451977168C6C55FDBB8856B8A597FE23C99F62300F18051AD98EF7283CE11DE01D352

Function 000F6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed164f075aef45cbf62344498d9acb0b56fd6f53942877fa71c08462a0db5d79
Instruction ID: 83e1b719a77c3f9e1b37c8abd5cf33fa2eed58322d96203af69dad9430a4ed7f
Opcode Fuzzy Hash: ed164f075aef45cbf62344498d9acb0b56fd6f53942877fa71c08462a0db5d79
Instruction Fuzzy Hash: C2323222D29F054DD7639634CC22336A289AFB73C5F15C737E81AB5EAAEB69C4C35101

Function 000DCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1daeb65b9b887988e0d5492a9fe2890e00cdc49ec5d53346e7f0deafe4ef91a
Instruction ID: 9ec4cc2e1abdf30387b77ddf22867a9f6e50c9886598dcb02bb9aeeaa7b6b11a
Opcode Fuzzy Hash: a1daeb65b9b887988e0d5492a9fe2890e00cdc49ec5d53346e7f0deafe4ef91a
Instruction Fuzzy Hash: B5320131A842168BDF2CCA28C594AFD7BA1AF45300F29817BD95A8B791E330DDC1DBD1

Function 000C7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a2ac45b9f796ffc62fd9332919ff93a8e7b5514d0c3973f92211de025491a0
Instruction ID: 3c31fdb879a3ca499b5864be6133bd625d96bae0837d560d6aa964c72ef2455d
Opcode Fuzzy Hash: 78a2ac45b9f796ffc62fd9332919ff93a8e7b5514d0c3973f92211de025491a0
Instruction Fuzzy Hash: 41227D70A0460A9FDF14CFA4C881BEEB7B6FF44300F144529E856AB291EB76AE55CF50

Function 000C91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898f41407d374380835054dde5fc4e3d97faccd3bbba5376b4e7a5c5131d8235
Instruction ID: 527bba27562e6b7fee4cf4fab65104abc428ae5ca697ed64da699e87014f551e
Opcode Fuzzy Hash: 898f41407d374380835054dde5fc4e3d97faccd3bbba5376b4e7a5c5131d8235
Instruction Fuzzy Hash: 0E02C5B0A0020AEBDB04DF55D981BAEB7F5FF44300F118569E8569B3D1EB71EA60CB91

Function 000F9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ca1fd8d81b0cba7fb012033828080419b2c722fd7c69da08ce72450fbada8e
Instruction ID: 433662b67baf602453a4bd049faa5d086f73dbfdd06aff0391860febcfbb5e02
Opcode Fuzzy Hash: 30ca1fd8d81b0cba7fb012033828080419b2c722fd7c69da08ce72450fbada8e
Instruction Fuzzy Hash: 85B1D020E2AF414DD22396398C75336B65CBFBB6D5B91D71BFC2A74E62EB2186C34140

Function 000E1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 83586e4f31aa9770d4b25d885616c28e0874cee028d1af9f8970685c8eb0108f
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 7091757260D0E34EDB69463B85744BEFFE15F923A131A079EE4F2EA1C1EE348954D620

Function 000E1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 037939f9f7862a6f396234533332b665b873ce0395ad2e1b55692462f9fde572
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: A79178722090E34DDBAD423B857407EFFE55B923A131A07ADD4F2EB1D6EE24CA54D620

Function 000E19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 930e137f5fe05022a88224b11b57d7163c88818408e11b138ed99675d706f060
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 5A9110722090E34EDBA9467B85740BEFFE15B923A131E07AED4F2EA1C1FE348554D620

Function 000E7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4ed5df518b71ff1141161c4ca5776b39a58ea48c0641888a82d93f6dd532c0
Instruction ID: 43e36337a6b00c3a361aec025f8c72ffa79d6bd9efd61115ee6c8d4604ec960c
Opcode Fuzzy Hash: 2a4ed5df518b71ff1141161c4ca5776b39a58ea48c0641888a82d93f6dd532c0
Instruction Fuzzy Hash: F5616A716087C99EDAB4992B4855BFF33D8DF81700F28492DE94EFB282D7119E42C316

Function 000E7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3676d619fea96b7672b781962a8bd76f7ee755a8a224e947ea0908db589811d
Instruction ID: 0175598e64e41a756dca68d92176390ebbe10a6eced97735d38570edcbc48924
Opcode Fuzzy Hash: a3676d619fea96b7672b781962a8bd76f7ee755a8a224e947ea0908db589811d
Instruction Fuzzy Hash: 1E61897120C7C96EDAB84A2B4C91BFE23E9DF46700F10495AE84FFB382DA129D428311

Function 000E1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 851cbf7890a22c5ec2f426a73c8a012cebcbc9b46d1f71a18e656659bbd6678b
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 888150726090E34EDBAD423B85744BEFFE15B923A131A079ED4F2DA1C2EE348554E620

Function 00132046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee4ba6130d4f83a450e2360fc425a827998d09906dc4116e31f1cd4938c05e9
Instruction ID: 6a96f9a6200a82dd70e9322c4ec9f8a680acdde617eb360df9d1431bad13ed2b
Opcode Fuzzy Hash: 5ee4ba6130d4f83a450e2360fc425a827998d09906dc4116e31f1cd4938c05e9
Instruction Fuzzy Hash: 9E21E7322216118BDB2CCF79C8236BE73E5A754320F14862EE4A7C37D0DE39A944CB80

Function 00142ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00142B30
DeleteObject.GDI32(00000000), ref: 00142B43
DestroyWindow.USER32 ref: 00142B52
GetDesktopWindow.USER32 ref: 00142B6D
GetWindowRect.USER32(00000000), ref: 00142B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00142CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00142CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142CF8
GetClientRect.USER32(00000000,?), ref: 00142D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00142D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142DA8
GlobalFree.KERNEL32(00000000), ref: 00142DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0015FC38,00000000), ref: 00142DDB
GlobalFree.KERNEL32(00000000), ref: 00142DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00142E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00142E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0014303F

Strings

AutoIt v3, xrefs: 00142CF2
static, xrefs: 00142D3A, 00142E91
DISPLAY, xrefs: 00142EA2
, xrefs: 00142FC5

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 7363406f8dcebc8360c5071a2104ff5fb8dcd94dc4e7ec7224bdaa4fea7c5db3
Instruction ID: 4de34e1fb412a2601c910401f35bf77e640deb5981bd2cc4c83d74c21d60fe5b
Opcode Fuzzy Hash: 7363406f8dcebc8360c5071a2104ff5fb8dcd94dc4e7ec7224bdaa4fea7c5db3
Instruction Fuzzy Hash: 52025A71900205EFDB14DF64CC89EAE7BB9FB48711F048158F915AB2A1CB70AE81CFA0

Function 001570D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0015712F
GetSysColorBrush.USER32(0000000F), ref: 00157160
GetSysColor.USER32(0000000F), ref: 0015716C
SetBkColor.GDI32(?,000000FF), ref: 00157186
SelectObject.GDI32(?,?), ref: 00157195
InflateRect.USER32(?,000000FF,000000FF), ref: 001571C0
GetSysColor.USER32(00000010), ref: 001571C8
CreateSolidBrush.GDI32(00000000), ref: 001571CF
FrameRect.USER32(?,?,00000000), ref: 001571DE
DeleteObject.GDI32(00000000), ref: 001571E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00157230
FillRect.USER32(?,?,?), ref: 00157262
GetWindowLongW.USER32(?,000000F0), ref: 00157284

Part of subcall function 001573E8: GetSysColor.USER32(00000012), ref: 00157421
Part of subcall function 001573E8: SetTextColor.GDI32(?,?), ref: 00157425
Part of subcall function 001573E8: GetSysColorBrush.USER32(0000000F), ref: 0015743B
Part of subcall function 001573E8: GetSysColor.USER32(0000000F), ref: 00157446
Part of subcall function 001573E8: GetSysColor.USER32(00000011), ref: 00157463
Part of subcall function 001573E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00157471
Part of subcall function 001573E8: SelectObject.GDI32(?,00000000), ref: 00157482
Part of subcall function 001573E8: SetBkColor.GDI32(?,00000000), ref: 0015748B
Part of subcall function 001573E8: SelectObject.GDI32(?,?), ref: 00157498
Part of subcall function 001573E8: InflateRect.USER32(?,000000FF,000000FF), ref: 001574B7
Part of subcall function 001573E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001574CE
Part of subcall function 001573E8: GetWindowLongW.USER32(00000000,000000F0), ref: 001574DB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 32929a6d3e134aec25ab7a5563328679624bcc4a3b9be19b9b6650ac80a6ff2e
Instruction ID: 02c6def1ba9cedb79cbe5dbbef64dfce3deb2ab31fdc2b09f191e32d9507cd87
Opcode Fuzzy Hash: 32929a6d3e134aec25ab7a5563328679624bcc4a3b9be19b9b6650ac80a6ff2e
Instruction Fuzzy Hash: F1A1A572108701FFD7019F60DC49E5BBBAAFF89322F100A19F9629A5E1D771E984CB91

Function 000D8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 000D8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00116AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00116AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00116F43

Part of subcall function 000D8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,000D8BE8,?,00000000,?,?,?,?,000D8BBA,00000000,?), ref: 000D8FC5

SendMessageW.USER32(?,00001053), ref: 00116F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00116F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00116FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00116FB7

Strings

0, xrefs: 00116DCF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 08baadfc898c45e0640acd6cb7c42f2ac840e1681ffea36970423f2431de854f
Instruction ID: b8aa2e3e0aeb097bd7c1089dd375ae34cdd0dc0c80e05c1aedd0b743d68694cf
Opcode Fuzzy Hash: 08baadfc898c45e0640acd6cb7c42f2ac840e1681ffea36970423f2431de854f
Instruction Fuzzy Hash: 2B128C30205312EFDB29CF14D858BEAB7E5FB44305F14856AF4858B661CB32A8D2DFA1

Function 00142711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0014273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0014286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 001428A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 001428B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00142900
GetClientRect.USER32(00000000,?), ref: 0014290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00142955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00142964
GetStockObject.GDI32(00000011), ref: 00142974
SelectObject.GDI32(00000000,00000000), ref: 00142978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00142988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00142991
DeleteDC.GDI32(00000000), ref: 0014299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 001429C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 001429DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00142A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00142A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00142A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00142A77
GetStockObject.GDI32(00000011), ref: 00142A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00142A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00142A97

Strings

AutoIt v3, xrefs: 001428F8
msctls_progress32, xrefs: 00142A13
static, xrefs: 0014294F, 00142A71
DISPLAY, xrefs: 0014295A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: e1eb5a711548eb622f23fb6431964f457ef3011db29f117bf7ca2ec293040e3b
Instruction ID: 19d972074b38e38aa07cca1a40d5eff3890e5c26af8a50782d8d77fb41b9c231
Opcode Fuzzy Hash: e1eb5a711548eb622f23fb6431964f457ef3011db29f117bf7ca2ec293040e3b
Instruction Fuzzy Hash: D9B13C71A00615AFEB14DF68CC86FAE7BB9FB08711F004519F915EB6A1D774AD80CB90

Function 00134ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00134AED
GetDriveTypeW.KERNEL32(?,0015CB68,?,\\.\,0015CC08), ref: 00134BCA
SetErrorMode.KERNEL32(00000000,0015CB68,?,\\.\,0015CC08), ref: 00134D36

Strings

RAMDisk, xrefs: 00134BF4
SSD, xrefs: 00134C4A
Unknown, xrefs: 00134BED, 00134C83
Fixed, xrefs: 00134C09
SSA, xrefs: 00134CA6
Network, xrefs: 00134C02
ATAPI, xrefs: 00134C91
\\.\, xrefs: 00134B3F
RAID, xrefs: 00134CBB
SATA, xrefs: 00134CD0
iSCSI, xrefs: 00134CC2
SAS, xrefs: 00134CC9
SCSI, xrefs: 00134C8A
ATA, xrefs: 00134C98
MMC, xrefs: 00134CDE
Virtual, xrefs: 00134CE5
1394, xrefs: 00134C9F
Removable, xrefs: 00134C10, 00134C15
CDROM, xrefs: 00134BFB
USB, xrefs: 00134CB4
PhysicalDrive, xrefs: 00134B76
Fibre, xrefs: 00134CAD
FileBackedVirtual, xrefs: 00134CEC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f2ae40cf978348a82ca8b9e4afe7fc11772b5c6b51370979863527363edec4db
Instruction ID: 998e03fb4a306c50beadfce79322d0515ef682594c7de93f43e773dff12036af
Opcode Fuzzy Hash: f2ae40cf978348a82ca8b9e4afe7fc11772b5c6b51370979863527363edec4db
Instruction Fuzzy Hash: D661B030605205DFCB08EF64CA82EADB7A0EB04340F249519F846AB692DB76FE45DF81

Function 001573E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00157421
SetTextColor.GDI32(?,?), ref: 00157425
GetSysColorBrush.USER32(0000000F), ref: 0015743B
GetSysColor.USER32(0000000F), ref: 00157446
CreateSolidBrush.GDI32(?), ref: 0015744B
GetSysColor.USER32(00000011), ref: 00157463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00157471
SelectObject.GDI32(?,00000000), ref: 00157482
SetBkColor.GDI32(?,00000000), ref: 0015748B
SelectObject.GDI32(?,?), ref: 00157498
InflateRect.USER32(?,000000FF,000000FF), ref: 001574B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001574CE
GetWindowLongW.USER32(00000000,000000F0), ref: 001574DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0015752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00157554
InflateRect.USER32(?,000000FD,000000FD), ref: 00157572
DrawFocusRect.USER32(?,?), ref: 0015757D
GetSysColor.USER32(00000011), ref: 0015758E
SetTextColor.GDI32(?,00000000), ref: 00157596
DrawTextW.USER32(?,001570F5,000000FF,?,00000000), ref: 001575A8
SelectObject.GDI32(?,?), ref: 001575BF
DeleteObject.GDI32(?), ref: 001575CA
SelectObject.GDI32(?,?), ref: 001575D0
DeleteObject.GDI32(?), ref: 001575D5
SetTextColor.GDI32(?,?), ref: 001575DB
SetBkColor.GDI32(?,?), ref: 001575E5

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 753739d28b9bd470676ba63a853f55f6f211926c0f14718a48ce37187349795f
Instruction ID: 25e42a27f3b71664d526bb835423b42d41127c5a032021fce651c8bedc5e7b25
Opcode Fuzzy Hash: 753739d28b9bd470676ba63a853f55f6f211926c0f14718a48ce37187349795f
Instruction Fuzzy Hash: 13613B72904318EFDB019FA4EC49AEEBFB9EB08322F114115F915AB2E1D7759980CB90

Function 00150FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00151128
GetDesktopWindow.USER32 ref: 0015113D
GetWindowRect.USER32(00000000), ref: 00151144
GetWindowLongW.USER32(?,000000F0), ref: 00151199
DestroyWindow.USER32(?), ref: 001511B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 001511ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0015120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0015121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00151232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00151245
IsWindowVisible.USER32(00000000), ref: 001512A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 001512BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 001512D0
GetWindowRect.USER32(00000000,?), ref: 001512E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0015130E
GetMonitorInfoW.USER32(00000000,?), ref: 00151328
CopyRect.USER32(?,?), ref: 0015133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 001513AA

Strings

0, xrefs: 001510D3
tooltips_class32, xrefs: 001511E6
(, xrefs: 0015131B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 81e81707e42c2c5c192aa5265c2fc888cdb9e0bb677eb29d19ed63df39699e03
Instruction ID: e569b84d83ba31c074701402a7c62c3421f1caa326d5d55af9177731a0552f2a
Opcode Fuzzy Hash: 81e81707e42c2c5c192aa5265c2fc888cdb9e0bb677eb29d19ed63df39699e03
Instruction Fuzzy Hash: 22B15771604341EFD705DF64C885BAABBE4FF88351F00891CF9A99B2A2D771E849CB91

Function 000D8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000D8968
GetSystemMetrics.USER32(00000007), ref: 000D8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000D899B
GetSystemMetrics.USER32(00000008), ref: 000D89A3
GetSystemMetrics.USER32(00000004), ref: 000D89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 000D89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 000D89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 000D8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 000D8A3C
GetClientRect.USER32(00000000,000000FF), ref: 000D8A5A
GetStockObject.GDI32(00000011), ref: 000D8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 000D8A81

Part of subcall function 000D912D: GetCursorPos.USER32(?), ref: 000D9141
Part of subcall function 000D912D: ScreenToClient.USER32(00000000,?), ref: 000D915E
Part of subcall function 000D912D: GetAsyncKeyState.USER32(00000001), ref: 000D9183
Part of subcall function 000D912D: GetAsyncKeyState.USER32(00000002), ref: 000D919D

SetTimer.USER32(00000000,00000000,00000028,000D90FC), ref: 000D8AA8

Strings

AutoIt v3 GUI, xrefs: 000D8A20

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 42d968cbe284ed608ab825a7b2956996f2686ef297158e8ae9ca6f4e0771058d
Instruction ID: 645244f3f7e8e79d5ac68d25678058ebd5b2a51b972d79b111b419c0005ef56b
Opcode Fuzzy Hash: 42d968cbe284ed608ab825a7b2956996f2686ef297158e8ae9ca6f4e0771058d
Instruction Fuzzy Hash: C2B16F75A0030AEFDB14DFA8CC55BEE7BB5FB48315F10412AFA15AB290DB70A981CB51

Function 00120D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00121114
Part of subcall function 001210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121120
Part of subcall function 001210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 0012112F
Part of subcall function 001210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121136
Part of subcall function 001210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0012114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00120DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00120E29
GetLengthSid.ADVAPI32(?), ref: 00120E40
GetAce.ADVAPI32(?,00000000,?), ref: 00120E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00120E96
GetLengthSid.ADVAPI32(?), ref: 00120EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00120EB5
HeapAlloc.KERNEL32(00000000), ref: 00120EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00120EDD
CopySid.ADVAPI32(00000000), ref: 00120EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00120F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00120F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00120F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120F6E
HeapFree.KERNEL32(00000000), ref: 00120F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120F7E
HeapFree.KERNEL32(00000000), ref: 00120F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120F8E
HeapFree.KERNEL32(00000000), ref: 00120F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00120FA1
HeapFree.KERNEL32(00000000), ref: 00120FA8

Part of subcall function 00121193: GetProcessHeap.KERNEL32(00000008,00120BB1,?,00000000,?,00120BB1,?), ref: 001211A1
Part of subcall function 00121193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00120BB1,?), ref: 001211A8
Part of subcall function 00121193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00120BB1,?), ref: 001211B7

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: da880f43b62944f5c6a9a5d1690f618fa77749f5845f190df08a65cf3efe32e0
Instruction ID: 19652e365b2a03c1d3318dc9a9e76091de2655cdd5446f682e5a368ccdf26ebf
Opcode Fuzzy Hash: da880f43b62944f5c6a9a5d1690f618fa77749f5845f190df08a65cf3efe32e0
Instruction Fuzzy Hash: E3717D7290031AEFDF219FA4ED44BAEBBB8FF08311F044215F919A6192D7319955CBA0

Function 0014C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0014C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0015CC08,00000000,?,00000000,?,?), ref: 0014C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0014C5A4
_wcslen.LIBCMT ref: 0014C5F4
_wcslen.LIBCMT ref: 0014C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0014C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0014C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0014C84D
RegCloseKey.ADVAPI32(?), ref: 0014C881
RegCloseKey.ADVAPI32(00000000), ref: 0014C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0014C960

Strings

REG_EXPAND_SZ, xrefs: 0014C5CD
REG_DWORD, xrefs: 0014C804
REG_MULTI_SZ, xrefs: 0014C6F5
REG_QWORD, xrefs: 0014C8C3
REG_BINARY, xrefs: 0014C913
REG_SZ, xrefs: 0014C644

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: a80bc45cdfca166b64553092c118b30b703687d3e468984fbb64f7eba0bd9781
Instruction ID: e6687634511ce4ecaddcc61b7109a915ac0af0a325da96162150e83c2df140d9
Opcode Fuzzy Hash: a80bc45cdfca166b64553092c118b30b703687d3e468984fbb64f7eba0bd9781
Instruction Fuzzy Hash: C91224356046019FD754DF14C891F6EB7E5EF88724F15889CF88A9B2A2DB31ED41CB81

Function 0015091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001509C6
_wcslen.LIBCMT ref: 00150A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00150A54
_wcslen.LIBCMT ref: 00150A8A
_wcslen.LIBCMT ref: 00150B06
_wcslen.LIBCMT ref: 00150B81

Part of subcall function 000DF9F2: _wcslen.LIBCMT ref: 000DF9FD

Part of subcall function 00122BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00122BFA

Strings

COLLAPSE, xrefs: 00150B01, 00150B1C
EXPAND, xrefs: 00150BF8
CHECK, xrefs: 00150A85, 00150AA0
GETITEMCOUNT, xrefs: 00150C1E
EXISTS, xrefs: 00150B7C, 00150B97
GETTEXT, xrefs: 00150C97
GETTOTALCOUNT, xrefs: 001509F2, 00150A17
ISCHECKED, xrefs: 00150CE1
GETSELECTED, xrefs: 00150C4E
UNCHECK, xrefs: 00150D3E
SELECT, xrefs: 00150D11

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 5e236de13a9fbe29b267ef29b4924a6c1be32c606facdddcd387c580c903e7bf
Instruction ID: 2408238242c4c18d087d56b1da5a220560f726e0fbc177d3ac40108de0f904c8
Opcode Fuzzy Hash: 5e236de13a9fbe29b267ef29b4924a6c1be32c606facdddcd387c580c903e7bf
Instruction Fuzzy Hash: F7E1DF35208301CFC715DFA4C49096EB7E1BF98314B15895CF8AAAB3A2D730EE49CB81

Function 0014C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0014B6AE,?,?), ref: 0014C9B5
_wcslen.LIBCMT ref: 0014C9F1
_wcslen.LIBCMT ref: 0014CA68
_wcslen.LIBCMT ref: 0014CA9E
_wcslen.LIBCMT ref: 0014CAF9
_wcslen.LIBCMT ref: 0014CB2F
_wcslen.LIBCMT ref: 0014CB7F

Strings

HKLM, xrefs: 0014CA98, 0014CA9D
HKEY_USERS, xrefs: 0014CBDF
HKEY_CURRENT_USER, xrefs: 0014CBBD
HKCU, xrefs: 0014CBCE
HKEY_CLASSES_ROOT, xrefs: 0014CAF3, 0014CAF8
HKCR, xrefs: 0014CB29, 0014CB2E
HKEY_CURRENT_CONFIG, xrefs: 0014CB79, 0014CB7E
HKCC, xrefs: 0014CBAC
HKEY_LOCAL_MACHINE, xrefs: 0014CA62, 0014CA67
HKU, xrefs: 0014CBF0

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 6de378dadab809f07c84dade009ff97e38042545585b314a18bdfdd4d3237031
Instruction ID: ba71192b8de4c67bc6f792799368609e041d7518f69318802a0f1b4c6feaa0ae
Opcode Fuzzy Hash: 6de378dadab809f07c84dade009ff97e38042545585b314a18bdfdd4d3237031
Instruction Fuzzy Hash: 0671F33260116A8BCB60DF7CC9915FE3391AFA1794B350528F866A72A5FB31CE44C7E0

Function 0015833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0015835A
_wcslen.LIBCMT ref: 0015836E
_wcslen.LIBCMT ref: 00158391
_wcslen.LIBCMT ref: 001583B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 001583F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0015361A,?), ref: 0015844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00158487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 001584CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00158501
FreeLibrary.KERNEL32(?), ref: 0015850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0015851D
DestroyIcon.USER32(?), ref: 0015852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00158549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00158555

Strings

.dll, xrefs: 001583AB
.exe, xrefs: 00158388
.icl, xrefs: 00158368

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 5ea143b0b7b2a1a90818490b03d3079eacb38f8f2ef5ac0ac1d9ae790ed22348
Instruction ID: 7df2516ab6c7da0ac2d8d2d898f3f6545676ad3b5ec096f8992cb94430fc5223
Opcode Fuzzy Hash: 5ea143b0b7b2a1a90818490b03d3079eacb38f8f2ef5ac0ac1d9ae790ed22348
Instruction Fuzzy Hash: A2619E71510715FEEB149F64CC85BFE77A8BB08722F104509FD25EA1D1EBB4AA84CBA0

Function 000C7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#requireadmin, xrefs: 000C77FF
#ce, xrefs: 000C78ED
#comments-end, xrefs: 000C78D9
#pragma compile, xrefs: 000C77D3
#cs, xrefs: 000C7873, 000C78C5
Cannot parse #include, xrefs: 00105279
', xrefs: 00105169
#comments-start, xrefs: 000C785F, 000C78B1
#notrayicon, xrefs: 000C77E7
Unterminated group of comments, xrefs: 0010528C
#include-once, xrefs: 000C782F
#OnAutoItStartRegister, xrefs: 000C7817
", xrefs: 00105153
#include, xrefs: 000C7847
Bad directive syntax error, xrefs: 0010519A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: ed54a5aed4f8ed1da156d3af45627ed6a77359152810f079dac950c53f6eaf81
Instruction ID: 1e6e35bf46f4cc2f33a3c10eb107cdc4cc941da42b55dc8f86a87f3617b15e56
Opcode Fuzzy Hash: ed54a5aed4f8ed1da156d3af45627ed6a77359152810f079dac950c53f6eaf81
Instruction Fuzzy Hash: 6781C671644605BFDB20AF60DD42FEF37A9AF15300F044029F949AA2D7EBB0DA15DBA1

Function 00133E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00133EF8
_wcslen.LIBCMT ref: 00133F03
_wcslen.LIBCMT ref: 00133F5A
_wcslen.LIBCMT ref: 00133F98
GetDriveTypeW.KERNEL32(?), ref: 00133FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0013401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00134059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00134087

Strings

closed, xrefs: 00133F08, 00133F2D, 00133F46, 00133F7E, 00133F97
close, xrefs: 00133EFE, 00133F18
wait, xrefs: 00134044
type cdaudio alias cd wait, xrefs: 00134001
close cd wait, xrefs: 00134072
open , xrefs: 00133FE5
open, xrefs: 00133F54, 00133F59
set cd door , xrefs: 00134028

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 04c4f127418a6d123067e00d63641514a11b882ad0312244e10d68d4e545cebe
Instruction ID: e1324fc5dd033e8f354b299519768571aed88a4d96f33b628c37b87ee71531f3
Opcode Fuzzy Hash: 04c4f127418a6d123067e00d63641514a11b882ad0312244e10d68d4e545cebe
Instruction Fuzzy Hash: 6871E4326043019FC714EF24C8819AEB7F4EF94758F50492DF8A697252EB31EE45CB92

Function 00125A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00125A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00125A40
SetWindowTextW.USER32(?,?), ref: 00125A57
GetDlgItem.USER32(?,000003EA), ref: 00125A6C
SetWindowTextW.USER32(00000000,?), ref: 00125A72
GetDlgItem.USER32(?,000003E9), ref: 00125A82
SetWindowTextW.USER32(00000000,?), ref: 00125A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00125AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00125AC3
GetWindowRect.USER32(?,?), ref: 00125ACC
_wcslen.LIBCMT ref: 00125B33
SetWindowTextW.USER32(?,?), ref: 00125B6F
GetDesktopWindow.USER32 ref: 00125B75
GetWindowRect.USER32(00000000), ref: 00125B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00125BD3
GetClientRect.USER32(?,?), ref: 00125BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00125C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00125C2F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 4dc8b35a2e6ac1b94ede25e18b5fe45451c9df37b958aa25a92dd932edd23ae1
Instruction ID: 01ead19fd84c7799bd9ebce1306edf65559687e8f77d4d2c062cf4c5e9ef6f6e
Opcode Fuzzy Hash: 4dc8b35a2e6ac1b94ede25e18b5fe45451c9df37b958aa25a92dd932edd23ae1
Instruction Fuzzy Hash: 9771AD31900B19EFDB20DFA8DE85AAEBBF6FF48705F104518E182A76A0D770E950CB50

Function 0013FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0013FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0013FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0013FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0013FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0013FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0013FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0013FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0013FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0013FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0013FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0013FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0013FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0013FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0013FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0013FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0013FECC
GetCursorInfo.USER32(?), ref: 0013FEDC
GetLastError.KERNEL32 ref: 0013FF1E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 46e601b02e6e887497568bcdaf9b34c5cc6ee5fdec8574cf1ce6d2717dc663ba
Instruction ID: 8227b8106438cdfcf4e1ad1017a549735355ed5643a1fb5fb64055f5f4fa9014
Opcode Fuzzy Hash: 46e601b02e6e887497568bcdaf9b34c5cc6ee5fdec8574cf1ce6d2717dc663ba
Instruction Fuzzy Hash: 5D4124B1D04319AADB109FBA8C89C5EBFE8FF04754B50452AE51DEB281DB78D901CF91

Function 000E00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 000E00C6

Part of subcall function 000E00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0019070C,00000FA0,BDA7365D,?,?,?,?,001023B3,000000FF), ref: 000E011C
Part of subcall function 000E00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,001023B3,000000FF), ref: 000E0127
Part of subcall function 000E00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,001023B3,000000FF), ref: 000E0138
Part of subcall function 000E00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 000E014E
Part of subcall function 000E00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 000E015C
Part of subcall function 000E00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 000E016A
Part of subcall function 000E00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 000E0195
Part of subcall function 000E00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 000E01A0

___scrt_fastfail.LIBCMT ref: 000E00E7

Part of subcall function 000E00A3: __onexit.LIBCMT ref: 000E00A9

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 000E0122
InitializeConditionVariable, xrefs: 000E0148
WakeAllConditionVariable, xrefs: 000E0162
kernel32.dll, xrefs: 000E0133
SleepConditionVariableCS, xrefs: 000E0154

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 760f69713b5321131463fec95190ac7a8132f6708318221ccf88951f578287c9
Instruction ID: 236bb34a75d5f244cce21c7547222afc45e7153933c5d9457546064ce3327cfc
Opcode Fuzzy Hash: 760f69713b5321131463fec95190ac7a8132f6708318221ccf88951f578287c9
Instruction Fuzzy Hash: 1C21F932645751EFE7115FB5AC45B6A33E4EB04B62F00012AF841BE692DFF09C808AD0

Function 001230F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0012318D
_wcslen.LIBCMT ref: 001231F8

Strings

CLASS, xrefs: 00123188, 001231A5
TEXT, xrefs: 0012347C
INSTANCE, xrefs: 00123453
CLASSNN, xrefs: 001231F3, 00123204
REGEXPCLASS, xrefs: 00123255, 00123266
NAME, xrefs: 00123335, 00123346

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 00c441e81a6089ce720a64ec8007df639cba6ee77662d1f387ecb5788f41c859
Instruction ID: 247c8405862d2c4b2935202e5087541e389075fec99b45b63e3c799692ec0870
Opcode Fuzzy Hash: 00c441e81a6089ce720a64ec8007df639cba6ee77662d1f387ecb5788f41c859
Instruction Fuzzy Hash: F3E11632A00626ABCB18EF64D451BEDFBB1FF14710F15811AE466F7241DB34AFA58B90

Function 001344C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0015CC08), ref: 00134527
_wcslen.LIBCMT ref: 0013453B
_wcslen.LIBCMT ref: 00134599
_wcslen.LIBCMT ref: 001345F4
_wcslen.LIBCMT ref: 0013463F
_wcslen.LIBCMT ref: 001346A7

Part of subcall function 000DF9F2: _wcslen.LIBCMT ref: 000DF9FD

GetDriveTypeW.KERNEL32(?,00186BF0,00000061), ref: 00134743

Strings

fixed, xrefs: 00134635, 0013463A
removable, xrefs: 001345EA, 001345EF
cdrom, xrefs: 0013458F, 00134594
network, xrefs: 0013469D, 001346A2
ramdisk, xrefs: 001346F1
unknown, xrefs: 00134708
all, xrefs: 00134531, 00134536

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: a920066676022d3eb3e7a9198d15f02f9475ea183588fe8ea76fed8333a5a424
Instruction ID: c103ab668acc3ceb852348c2e8eb574703daf677a8d59328495e2b5f83d6b7f0
Opcode Fuzzy Hash: a920066676022d3eb3e7a9198d15f02f9475ea183588fe8ea76fed8333a5a424
Instruction Fuzzy Hash: 51B122716083029FC710DF28C891AAEB7E4BFA5764F50491DF496D7292E730E944CB92

Function 00143FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0015CC08), ref: 001440BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 001440CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0015CC08), ref: 001440F2
FreeLibrary.KERNEL32(00000000,?,0015CC08), ref: 0014413E
StringFromGUID2.OLE32(?,?,00000028,?,0015CC08), ref: 001441A8
SysFreeString.OLEAUT32(00000009), ref: 00144262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 001442C8
SysFreeString.OLEAUT32(?), ref: 001442F2

Strings

kernel32.dll, xrefs: 001440B6
GetModuleHandleExW, xrefs: 001440C7

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: a7ce5a45a06a3a801a3a4a005256586d1d59e5b252913a52ce681c337ac7ca90
Instruction ID: 3c3b514c0ff2d360c41ce67fa40362df074de20b6a22c852abe0133463f44bc5
Opcode Fuzzy Hash: a7ce5a45a06a3a801a3a4a005256586d1d59e5b252913a52ce681c337ac7ca90
Instruction Fuzzy Hash: 97122775A00219EFDB14CF94C884EAEBBB5BF45314F258098F905AB261D731ED86CBA0

Function 000C326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00191990), ref: 00102F8D
GetMenuItemCount.USER32(00191990), ref: 0010303D
GetCursorPos.USER32(?), ref: 00103081
SetForegroundWindow.USER32(00000000), ref: 0010308A
TrackPopupMenuEx.USER32(00191990,00000000,?,00000000,00000000,00000000), ref: 0010309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 001030A9

Strings

0, xrefs: 000C327D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 9889443a608f560bdcc809eb3ef91425c2a7764c931ca62b85d1fdd47d21ce77
Instruction ID: 3a08711eb1169e27aa523df3b0738d10d8216f2ce975fdcf56c8612a88a28428
Opcode Fuzzy Hash: 9889443a608f560bdcc809eb3ef91425c2a7764c931ca62b85d1fdd47d21ce77
Instruction Fuzzy Hash: 2371F370644216BFEB259F64DC89FAEBF68FF05364F208216F5256A1E0C7B1A950CB90

Function 00156CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00156DEB

Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00156E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00156E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00156E94
DestroyWindow.USER32(?), ref: 00156EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,000C0000,00000000), ref: 00156EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00156EFD
GetDesktopWindow.USER32 ref: 00156F16
GetWindowRect.USER32(00000000), ref: 00156F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00156F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00156F4D

Part of subcall function 000D9944: GetWindowLongW.USER32(?,000000EB), ref: 000D9952

Strings

0, xrefs: 00156D98
tooltips_class32, xrefs: 00156E58, 00156EDD

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 7eaa074694f524a8d4f232a1e85890d5640e446b0e7a9fb2d493316559fde984
Instruction ID: d2980b75ff6e75737208885cc1f0d7b50dc683c001117cde9582acf292676948
Opcode Fuzzy Hash: 7eaa074694f524a8d4f232a1e85890d5640e446b0e7a9fb2d493316559fde984
Instruction Fuzzy Hash: 34717970504341EFDB21CF18DC54FAABBE9FB99305F44051EF9998B261C770A98ACB91

Function 0015911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2

DragQueryPoint.SHELL32(?,?), ref: 00159147

Part of subcall function 00157674: ClientToScreen.USER32(?,?), ref: 0015769A
Part of subcall function 00157674: GetWindowRect.USER32(?,?), ref: 00157710
Part of subcall function 00157674: PtInRect.USER32(?,?,00158B89), ref: 00157720

SendMessageW.USER32(?,000000B0,?,?), ref: 001591B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 001591BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 001591DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00159225
SendMessageW.USER32(?,000000B0,?,?), ref: 0015923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00159255
SendMessageW.USER32(?,000000B1,?,?), ref: 00159277
DragFinish.SHELL32(?), ref: 0015927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00159371

Strings

@GUI_DRAGFILE, xrefs: 00159320
@GUI_DRAGID, xrefs: 001592E9
@GUI_DROPID, xrefs: 0015929E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: b8959c2d926252fc0efe45f2c3facacfe9743d327c6a795543d0d92941d11c24
Instruction ID: 8f56bcae9c06a40d9ba44279aef907fe2b3af17fbbcf772b7234567bf0220311
Opcode Fuzzy Hash: b8959c2d926252fc0efe45f2c3facacfe9743d327c6a795543d0d92941d11c24
Instruction Fuzzy Hash: 7D616B71108301EFD701EF64DC85EAFBBE8EF89750F00092EF5A5961A1DB709A49CB92

Function 0013C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0013C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0013C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0013C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0013C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0013C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0013C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0013C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0013C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0013C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0013C5F0
InternetCloseHandle.WININET(00000000), ref: 0013C5FB

Strings

, xrefs: 0013C575

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: d19888c2a921183d54c650650c8e2e847c450c8aa866fa2d91dd59d42f53eed4
Instruction ID: 5f23fd5e2e8e4be735ef458e4e079bc816384679c890b866a131984e1052eb96
Opcode Fuzzy Hash: d19888c2a921183d54c650650c8e2e847c450c8aa866fa2d91dd59d42f53eed4
Instruction Fuzzy Hash: BC514AB1600709FFDB219FA4CD88AAB7BBCFF08755F004419F945AA610DB35E944DBA0

Function 0015856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00158592
GetFileSize.KERNEL32(00000000,00000000), ref: 001585A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 001585AD
CloseHandle.KERNEL32(00000000), ref: 001585BA
GlobalLock.KERNEL32(00000000), ref: 001585C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 001585D7
GlobalUnlock.KERNEL32(00000000), ref: 001585E0
CloseHandle.KERNEL32(00000000), ref: 001585E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 001585F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0015FC38,?), ref: 00158611
GlobalFree.KERNEL32(00000000), ref: 00158621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00158641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00158671
DeleteObject.GDI32(00000000), ref: 00158699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 001586AF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 0c8fa17a97642f755febb525b334915dbabbf168e3137a1df8689729a8cbff3e
Instruction ID: b0f1f65f32c0a6856486671a90a9eadb47acc76410925d20c70a015f5acbdc6c
Opcode Fuzzy Hash: 0c8fa17a97642f755febb525b334915dbabbf168e3137a1df8689729a8cbff3e
Instruction Fuzzy Hash: 4D411975600308EFDB119FA5CC88EAA7BB8FF89716F104158F916EB260DB309945CF60

Function 001314BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00131502
VariantCopy.OLEAUT32(?,?), ref: 0013150B
VariantClear.OLEAUT32(?), ref: 00131517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 001315FB
VarR8FromDec.OLEAUT32(?,?), ref: 00131657
VariantInit.OLEAUT32(?), ref: 00131708
SysFreeString.OLEAUT32(?), ref: 0013178C
VariantClear.OLEAUT32(?), ref: 001317D8
VariantClear.OLEAUT32(?), ref: 001317E7
VariantInit.OLEAUT32(00000000), ref: 00131823

Strings

Default, xrefs: 001316AF
%4d%02d%02d%02d%02d%02d, xrefs: 00131625

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: b535db231bafdeeda101df038eb774179aa66f62c7cd12c978e4c5b102c68533
Instruction ID: 0915a7c330b09240b3886f15c830174774ab2cfe60df5b1d81c46a24b7f5bf9a
Opcode Fuzzy Hash: b535db231bafdeeda101df038eb774179aa66f62c7cd12c978e4c5b102c68533
Instruction Fuzzy Hash: CFD11031A00205FFDB18AF65E885BBDB7B5BF46700F15845AF806AB681DB30EC45DBA1

Function 0014B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 0014C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0014B6AE,?,?), ref: 0014C9B5
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014C9F1
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA68
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0014B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0014B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0014B80A
RegCloseKey.ADVAPI32(?), ref: 0014B87E
RegCloseKey.ADVAPI32(?), ref: 0014B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0014B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0014B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0014B922
FreeLibrary.KERNEL32(00000000), ref: 0014B983
RegCloseKey.ADVAPI32(00000000), ref: 0014B994

Strings

RegDeleteKeyExW, xrefs: 0014B8FE
advapi32.dll, xrefs: 0014B8ED

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 4e75b5ab40649feb6a14b9eedfbce8ae7dfd754ca8cbc32c0d7f60eded4c0608
Instruction ID: 8fbe726e8f38adfeba607226fa23e26b618d025a73c7fa4f196586af40bcc72d
Opcode Fuzzy Hash: 4e75b5ab40649feb6a14b9eedfbce8ae7dfd754ca8cbc32c0d7f60eded4c0608
Instruction Fuzzy Hash: A4C17874208202EFD714DF24C4D5F6ABBE5BF84318F14849CF49A8B6A2CB71E946CB91

Function 0014255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 001425D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 001425E8
CreateCompatibleDC.GDI32(?), ref: 001425F4
SelectObject.GDI32(00000000,?), ref: 00142601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0014266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 001426AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 001426D0
SelectObject.GDI32(?,?), ref: 001426D8
DeleteObject.GDI32(?), ref: 001426E1
DeleteDC.GDI32(?), ref: 001426E8
ReleaseDC.USER32(00000000,?), ref: 001426F3

Strings

(, xrefs: 0014268D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: c68d5358156bde34c7eb1e1cc2b12f9c21c7b6cf24d04eb71f6868cbf3728040
Instruction ID: 4c2e3508312c2c9584858dc80d611fe734d5d996d389a6372e76109831cfebda
Opcode Fuzzy Hash: c68d5358156bde34c7eb1e1cc2b12f9c21c7b6cf24d04eb71f6868cbf3728040
Instruction Fuzzy Hash: C861C2B5D00319EFCF04CFA4D884AAEBBB6FF58310F208529E955A7250D774A991CFA4

Function 000FDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 000FDAA1

Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD659
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD66B
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD67D
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD68F
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6A1
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6B3
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6C5
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6D7
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6E9
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6FB
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD70D
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD71F
Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD731

_free.LIBCMT ref: 000FDA96

Part of subcall function 000F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0

_free.LIBCMT ref: 000FDAB8
_free.LIBCMT ref: 000FDACD
_free.LIBCMT ref: 000FDAD8
_free.LIBCMT ref: 000FDAFA
_free.LIBCMT ref: 000FDB0D
_free.LIBCMT ref: 000FDB1B
_free.LIBCMT ref: 000FDB26
_free.LIBCMT ref: 000FDB5E
_free.LIBCMT ref: 000FDB65
_free.LIBCMT ref: 000FDB82
_free.LIBCMT ref: 000FDB9A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 44a7414a05fab99229b56e84bab1b8cc108dcfb15be0be11828b64f3651803f2
Instruction ID: 54801464c650d73b0089b187211de4d4d6f7d060ebbdc5af317783c079803a48
Opcode Fuzzy Hash: 44a7414a05fab99229b56e84bab1b8cc108dcfb15be0be11828b64f3651803f2
Instruction Fuzzy Hash: 1C315D31648209DFDB61AA38E845BBA77EAFF00311F11451AE648D7992DB71EC40A724

Function 0012365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0012369C
_wcslen.LIBCMT ref: 001236A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00123797
GetClassNameW.USER32(?,?,00000400), ref: 0012380C
GetDlgCtrlID.USER32(?), ref: 0012385D
GetWindowRect.USER32(?,?), ref: 00123882
GetParent.USER32(?), ref: 001238A0
ScreenToClient.USER32(00000000), ref: 001238A7
GetClassNameW.USER32(?,?,00000100), ref: 00123921
GetWindowTextW.USER32(?,?,00000400), ref: 0012395D

Strings

%s%u, xrefs: 00123734

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 135b83dd3335524cf894bf577f3feb09718d20ee3008f27bca49594049512905
Instruction ID: 480a31db8b32b5e535182d0387b0e098785cb1b9e162939a7e21de1952dec1e7
Opcode Fuzzy Hash: 135b83dd3335524cf894bf577f3feb09718d20ee3008f27bca49594049512905
Instruction Fuzzy Hash: 1E91E371204316AFDB08DF24D884BEAF7A9FF45304F004619F9A9D6190DB34EAA5CB91

Function 00124954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00124994
GetWindowTextW.USER32(?,?,00000400), ref: 001249DA
_wcslen.LIBCMT ref: 001249EB
CharUpperBuffW.USER32(?,00000000), ref: 001249F7
_wcsstr.LIBVCRUNTIME ref: 00124A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00124A64
GetWindowTextW.USER32(?,?,00000400), ref: 00124A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00124AE6
GetClassNameW.USER32(?,?,00000400), ref: 00124B20
GetWindowRect.USER32(?,?), ref: 00124B8B

Strings

ThumbnailClass, xrefs: 00124A6F, 00124AF1

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 308d0c42f6f7124e3cab3b6a753846d4b14354525f4da66b29aee3a1368a4e52
Instruction ID: 5090bb3938485a6161690a36c5c875d10435fc34155902632d65c64268a50c82
Opcode Fuzzy Hash: 308d0c42f6f7124e3cab3b6a753846d4b14354525f4da66b29aee3a1368a4e52
Instruction Fuzzy Hash: 3D91DE710043259FDB04DF14E985FAA77E8FF84314F048469FD869A196EB30EE65CBA1

Function 0012BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00191990,000000FF,00000000,00000030), ref: 0012BFAC
SetMenuItemInfoW.USER32(00191990,00000004,00000000,00000030), ref: 0012BFE1
Sleep.KERNEL32(000001F4), ref: 0012BFF3
GetMenuItemCount.USER32(?), ref: 0012C039
GetMenuItemID.USER32(?,00000000), ref: 0012C056
GetMenuItemID.USER32(?,-00000001), ref: 0012C082
GetMenuItemID.USER32(?,?), ref: 0012C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0012C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0012C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0012C145

Strings

0, xrefs: 0012BF3D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: dd7b40be28e83d18e2be8b5af2b11344e51f5be6070ad57782e8ae72e00cc6bb
Instruction ID: c86eed222bebbf01e171fc6fa06880ad389cd12d8aee5ca19b3b10d34afd9baa
Opcode Fuzzy Hash: dd7b40be28e83d18e2be8b5af2b11344e51f5be6070ad57782e8ae72e00cc6bb
Instruction Fuzzy Hash: 4E619E70A00366EFDB15CF64ED89AEEBBB8EF05344F140015FA01A7291D731AE65CBA0

Function 0014CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0014CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0014CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0014CD48

Part of subcall function 0014CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0014CCAA
Part of subcall function 0014CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0014CCBD
Part of subcall function 0014CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0014CCCF
Part of subcall function 0014CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0014CD05
Part of subcall function 0014CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0014CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0014CCF3

Strings

RegDeleteKeyExW, xrefs: 0014CCC9
advapi32.dll, xrefs: 0014CCB8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: d0af634a031b4a05b1823aec30b54fa9eda5a19ba3d89a7935f3658f370c6403
Instruction ID: 17e2d857282f53764eb53dca7a893d6bf258bca37461a61be06c5ec37b728b77
Opcode Fuzzy Hash: d0af634a031b4a05b1823aec30b54fa9eda5a19ba3d89a7935f3658f370c6403
Instruction Fuzzy Hash: C2316975902229FBDB209F94DC88EEFBB7CEF45751F000165B906E6260DB309A85DAE0

Function 00133D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00133D40
_wcslen.LIBCMT ref: 00133D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00133D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00133DBE
RemoveDirectoryW.KERNEL32(?), ref: 00133DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00133E55
CloseHandle.KERNEL32(00000000), ref: 00133E60
CloseHandle.KERNEL32(00000000), ref: 00133E6B

Strings

:, xrefs: 00133D82
\, xrefs: 00133D77
\??\%s, xrefs: 00133D5B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: e2d8c329fcc4c14f5a61f8cb2a95ba4b11d595abf7eba5e790a9bfe804e0bc0c
Instruction ID: ef5e767c80928eb84f85cfa2056a9666bc53ce23669ed370d4d7d9ffa64e9293
Opcode Fuzzy Hash: e2d8c329fcc4c14f5a61f8cb2a95ba4b11d595abf7eba5e790a9bfe804e0bc0c
Instruction Fuzzy Hash: 6F31A171900209ABDB219FA0DC49FEB37BDEF88701F5040B6F619E6061EB7497848B68

Function 0012E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0012E6B4

Part of subcall function 000DE551: timeGetTime.WINMM(?,?,0012E6D4), ref: 000DE555

Sleep.KERNEL32(0000000A), ref: 0012E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0012E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0012E727
SetActiveWindow.USER32 ref: 0012E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0012E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0012E773
Sleep.KERNEL32(000000FA), ref: 0012E77E
IsWindow.USER32 ref: 0012E78A
EndDialog.USER32(00000000), ref: 0012E79B

Strings

BUTTON, xrefs: 0012E719

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: f1666b891133d20e7e25230337679ec41063a87a9ab86da56b3d1505cc3b3cef
Instruction ID: a58cd018d3710180bd8d65ffac8d44d0f9de0e42b03d2402974624867fe727ad
Opcode Fuzzy Hash: f1666b891133d20e7e25230337679ec41063a87a9ab86da56b3d1505cc3b3cef
Instruction Fuzzy Hash: 6A21A570204315FFEB105F60FCC9A253BA9F75474AF200426F91686EB2DB71ADE08BA4

Function 0012E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0012EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0012EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0012EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0012EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0012EAA7

Strings

alias PlayMe, xrefs: 0012EA36
close PlayMe, xrefs: 0012EA6E, 0012EA9B
play PlayMe, xrefs: 0012EAA2
play PlayMe wait, xrefs: 0012EA91
open , xrefs: 0012EA0C
status PlayMe mode, xrefs: 0012EA58

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 2142bb915ad185d3f43c4d5aea8c94bd5a6eb44fe6d9736b7a9bcef4bdf08632
Instruction ID: 4fea441773fe8b1a09985cf6a30ba43b2cd82b4a57931bd6c05a91cf430b7c37
Opcode Fuzzy Hash: 2142bb915ad185d3f43c4d5aea8c94bd5a6eb44fe6d9736b7a9bcef4bdf08632
Instruction Fuzzy Hash: DE112131A902697DD724B7A1EC4AEFF6ABCEBD1B04F400429B411A20D1EF705A55CAB0

Function 00129F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0012A012
SetKeyboardState.USER32(?), ref: 0012A07D
GetAsyncKeyState.USER32(000000A0), ref: 0012A09D
GetKeyState.USER32(000000A0), ref: 0012A0B4
GetAsyncKeyState.USER32(000000A1), ref: 0012A0E3
GetKeyState.USER32(000000A1), ref: 0012A0F4
GetAsyncKeyState.USER32(00000011), ref: 0012A120
GetKeyState.USER32(00000011), ref: 0012A12E
GetAsyncKeyState.USER32(00000012), ref: 0012A157
GetKeyState.USER32(00000012), ref: 0012A165
GetAsyncKeyState.USER32(0000005B), ref: 0012A18E
GetKeyState.USER32(0000005B), ref: 0012A19C

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 9025b4e355585ff980efb164c19ea2335440ecf858c8ab53cabd6563460a2a35
Instruction ID: 31eac235040f3ab7f83e59c9af97000a8d3e053d9c4869e1257ca020fd28132a
Opcode Fuzzy Hash: 9025b4e355585ff980efb164c19ea2335440ecf858c8ab53cabd6563460a2a35
Instruction Fuzzy Hash: 74513B309047A86BFB35DBB0A9107EABFF49F12380F484589D5C25B1C2DB54AA5CCB63

Function 00125CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00125CE2
GetWindowRect.USER32(00000000,?), ref: 00125CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00125D59
GetDlgItem.USER32(?,00000002), ref: 00125D69
GetWindowRect.USER32(00000000,?), ref: 00125D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00125DCF
GetDlgItem.USER32(?,000003E9), ref: 00125DDD
GetWindowRect.USER32(00000000,?), ref: 00125DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00125E31
GetDlgItem.USER32(?,000003EA), ref: 00125E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00125E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00125E67

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d24021537454a9bf3f907bff1e5ebea5b89bb2bab4d9252a0a944edb1858ad3e
Instruction ID: e0b0a436e47fad12bc0bf8fb4459cd6f825917ef28f508afe612e0341c615152
Opcode Fuzzy Hash: d24021537454a9bf3f907bff1e5ebea5b89bb2bab4d9252a0a944edb1858ad3e
Instruction Fuzzy Hash: 23510E71A00719AFDB18CFA8DD89AAEBBB6FB48301F148129F515E6690D7709E50CB60

Function 000D8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 000D8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,000D8BE8,?,00000000,?,?,?,?,000D8BBA,00000000,?), ref: 000D8FC5

DestroyWindow.USER32(?), ref: 000D8C81
KillTimer.USER32(00000000,?,?,?,?,000D8BBA,00000000,?), ref: 000D8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00116973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,000D8BBA,00000000,?), ref: 001169A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,000D8BBA,00000000,?), ref: 001169B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,000D8BBA,00000000), ref: 001169D4
DeleteObject.GDI32(00000000), ref: 001169E6

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 4a060a5a6ba761a35917cdb94e5adba54827bc5c7a44a6de5f4502540710a681
Instruction ID: 4a78b3fe1fae012fc03417ef33207089292cc313ab8526b2cb5d0c57e93de223
Opcode Fuzzy Hash: 4a060a5a6ba761a35917cdb94e5adba54827bc5c7a44a6de5f4502540710a681
Instruction Fuzzy Hash: BD615B31512705EFCB359F14D958B69B7F1FB40316F14952EE0429BAA0CB72A9D0DFA0

Function 000D9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 000D9944: GetWindowLongW.USER32(?,000000EB), ref: 000D9952

GetSysColor.USER32(0000000F), ref: 000D9862

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 96ca41e5ccdc8fe27e111c38c50eef29cd3f8d4002b39584020aa135d6538297
Instruction ID: 14cfb096628b35d54e8bcd075968483ad8bad871b7f520c589705faf64c6e289
Opcode Fuzzy Hash: 96ca41e5ccdc8fe27e111c38c50eef29cd3f8d4002b39584020aa135d6538297
Instruction Fuzzy Hash: 35418331104740EFDB205F389C84BB977A6AB46731F144616F9A28B3E1DB319D81EB70

Function 001296E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0010F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00129717
LoadStringW.USER32(00000000,?,0010F7F8,00000001), ref: 00129720

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0010F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00129742
LoadStringW.USER32(00000000,?,0010F7F8,00000001), ref: 00129745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00129866

Strings

Error: , xrefs: 0012981D
^ ERROR, xrefs: 001297FB
Line %d (File "%s"):, xrefs: 0012978F
Line %d:, xrefs: 001297A0
%s (%d) : ==> %s: %s %s, xrefs: 0012984A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: e5fc23027440f85a10d2c9c7e3f87513130c49c3ed5a4931eb71d589f0c4b494
Instruction ID: 5876df78d53a17464e70d115a336cc4da9f8bdc0eb4f0bc5b85f1fca4be8a5fe
Opcode Fuzzy Hash: e5fc23027440f85a10d2c9c7e3f87513130c49c3ed5a4931eb71d589f0c4b494
Instruction Fuzzy Hash: 0A413D72900219AADF14FBE4DD86EEE7778AF15340F504129F60672092EF356F58CB61

Function 001206DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 001207A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 001207BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 001207DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00120804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0012082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00120837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0012083C

Strings

\IPC$, xrefs: 00120784
\CLSID, xrefs: 00120724
SOFTWARE\Classes\, xrefs: 0012070E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 4bb11b2108d3daf2a92c0ab430004c1664d622db696f67f984437899e420f64a
Instruction ID: de6f8bf96aeee6857be974838c53e2b797d65c6300a1f1f802d0518801f81bc0
Opcode Fuzzy Hash: 4bb11b2108d3daf2a92c0ab430004c1664d622db696f67f984437899e420f64a
Instruction Fuzzy Hash: E341E476D10229AFDB11EFA4DC85DEEB778FF48354B044129F901A71A2EB309E54CBA0

Function 00153F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0015403B
CreateCompatibleDC.GDI32(00000000), ref: 00154042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00154055
SelectObject.GDI32(00000000,00000000), ref: 0015405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00154068
DeleteDC.GDI32(00000000), ref: 00154072
GetWindowLongW.USER32(?,000000EC), ref: 0015407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00154092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 0015409E

Strings

static, xrefs: 00153FD3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: a1bd3020eef08acc7d65016ee19061f0de919b4cf0698c6d372cfad365866f73
Instruction ID: 7968fc448a6dc3f2a670f2fc497576012108683754f6bf4468fa173b176815a2
Opcode Fuzzy Hash: a1bd3020eef08acc7d65016ee19061f0de919b4cf0698c6d372cfad365866f73
Instruction Fuzzy Hash: 32317C32500315EFDF219FA4DC48FDA3B69EF0D366F110211FA25AA1A0C775D895DB90

Function 00143C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00143C5C
CoInitialize.OLE32(00000000), ref: 00143C8A
CoUninitialize.OLE32 ref: 00143C94
_wcslen.LIBCMT ref: 00143D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00143DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00143ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00143F0E
CoGetObject.OLE32(?,00000000,0015FB98,?), ref: 00143F2D
SetErrorMode.KERNEL32(00000000), ref: 00143F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00143FC4
VariantClear.OLEAUT32(?), ref: 00143FD8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 85be2c767c776b56c02f5d746bc9f2c1c05caf88e5439ccf48afb8b93c69f85e
Instruction ID: bf9b1c57f587a15db3651fe17e555c5cfcb80080e9e6a9a1d19609d508ccd787
Opcode Fuzzy Hash: 85be2c767c776b56c02f5d746bc9f2c1c05caf88e5439ccf48afb8b93c69f85e
Instruction Fuzzy Hash: A9C123716083019FD700DF68C88496BB7E9FF89744F10491DF99A9B261D731EE46CB92

Function 00137A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00137AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00137B8F
SHGetDesktopFolder.SHELL32(?), ref: 00137BA3
CoCreateInstance.OLE32(0015FD08,00000000,00000001,00186E6C,?), ref: 00137BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00137C74
CoTaskMemFree.OLE32(?,?), ref: 00137CCC
SHBrowseForFolderW.SHELL32(?), ref: 00137D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00137D7A
CoTaskMemFree.OLE32(00000000), ref: 00137D81
CoTaskMemFree.OLE32(00000000), ref: 00137DD6
CoUninitialize.OLE32 ref: 00137DDC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 4f2602ba6f221973c9524e7bb1de04df3e308128272666123e5d4d0286100ee4
Instruction ID: f0c3504625483b165e4b9c42c63b18c625737d6a8c6a15e751a433dda88d5b96
Opcode Fuzzy Hash: 4f2602ba6f221973c9524e7bb1de04df3e308128272666123e5d4d0286100ee4
Instruction Fuzzy Hash: 17C1EA75A04209AFCB14DFA4C884DAEBBF9FF48314F148499E8199B662D731EE45CB90

Function 0015541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00155504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00155515
CharNextW.USER32(00000158), ref: 00155544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00155585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0015559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001555AC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 6e2bb8ecdbd72e361acbca0e8c431f025595fdaa690cd0dfe625722e8ca9b562
Instruction ID: 7ee0a0b14d8fb4fd04923b4e9f5abff2cb74e370b505bf5d8549d86ed8c4a423
Opcode Fuzzy Hash: 6e2bb8ecdbd72e361acbca0e8c431f025595fdaa690cd0dfe625722e8ca9b562
Instruction Fuzzy Hash: 37617C30904609EFDF109F94CC95AFE7BBAFB09726F104145F935AE290E7749A88DB60

Function 0011FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0011FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0011FB08
VariantInit.OLEAUT32(?), ref: 0011FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0011FB3A
VariantCopy.OLEAUT32(?,?), ref: 0011FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0011FBA1
VariantClear.OLEAUT32(?), ref: 0011FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0011FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0011FBCC
VariantClear.OLEAUT32(?), ref: 0011FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0011FBE9

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: c6c68d8941ae88bd72afc0fb0589d402170e194057bb1ef3e655bba06954b599
Instruction ID: b4cb496ccc4a2975796af34420fc9f6ad9b866fa8f6d292d2dd75eb1752ee07c
Opcode Fuzzy Hash: c6c68d8941ae88bd72afc0fb0589d402170e194057bb1ef3e655bba06954b599
Instruction Fuzzy Hash: E0415F75A00319DFCB04DF64D854DEEBBB9FF58345F008079E945AB261DB30A986CBA0

Function 00129C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00129CA1
GetAsyncKeyState.USER32(000000A0), ref: 00129D22
GetKeyState.USER32(000000A0), ref: 00129D3D
GetAsyncKeyState.USER32(000000A1), ref: 00129D57
GetKeyState.USER32(000000A1), ref: 00129D6C
GetAsyncKeyState.USER32(00000011), ref: 00129D84
GetKeyState.USER32(00000011), ref: 00129D96
GetAsyncKeyState.USER32(00000012), ref: 00129DAE
GetKeyState.USER32(00000012), ref: 00129DC0
GetAsyncKeyState.USER32(0000005B), ref: 00129DD8
GetKeyState.USER32(0000005B), ref: 00129DEA

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 1b620b3900e70a997cfca1c9bf225d2bec416e30a6ca06fcfdb947a8610949a0
Instruction ID: 7c9cd0d0256c75f54ab36da518254ac273a8ebc6ac2c2c9a1e88b229d29df6eb
Opcode Fuzzy Hash: 1b620b3900e70a997cfca1c9bf225d2bec416e30a6ca06fcfdb947a8610949a0
Instruction Fuzzy Hash: 0741FC345047DE6DFF348BA8E4043B5BEE06F11344F04805ED6C65A5C2E7A499F4D7A2

Function 0014055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 001405BC
inet_addr.WSOCK32(?), ref: 0014061C
gethostbyname.WSOCK32(?), ref: 00140628
IcmpCreateFile.IPHLPAPI ref: 00140636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 001406C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 001406E5
IcmpCloseHandle.IPHLPAPI(?), ref: 001407B9
WSACleanup.WSOCK32 ref: 001407BF

Strings

Ping, xrefs: 00140676

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: bf3e71f14cb81cc9d41bf6332a6281139727f1dac116c6f89e7ce72f6a0e85d2
Instruction ID: 46ec6937932cda903066112976072cb269d454940828f2c1cd91040e92de4694
Opcode Fuzzy Hash: bf3e71f14cb81cc9d41bf6332a6281139727f1dac116c6f89e7ce72f6a0e85d2
Instruction Fuzzy Hash: 1C916E355047019FD321DF16C889F1ABBE0EF48319F1585A9E5AA8BAB2C730ED45CF92

Function 00148CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00148CF3

Part of subcall function 00128E54: _wcslen.LIBCMT ref: 00128E77

_wcslen.LIBCMT ref: 00148D4E
_wcslen.LIBCMT ref: 00148D9C
_wcslen.LIBCMT ref: 00148DDC
_wcslen.LIBCMT ref: 00148E6E

Strings

winapi, xrefs: 00148D96, 00148D9B
none, xrefs: 00148E65, 00148E6A
cdecl, xrefs: 00148D48, 00148D4D
stdcall, xrefs: 00148DD6, 00148DDB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 529fce010819f0901a7c7c537ecda959fbbcf596872a6b4daf42c90e3193fd42
Instruction ID: 37b8f98a9e250c87da76ce246a956fe6c76d74ab0641e8e85e6da8600c6f535a
Opcode Fuzzy Hash: 529fce010819f0901a7c7c537ecda959fbbcf596872a6b4daf42c90e3193fd42
Instruction Fuzzy Hash: 82519F31A011169BCB24EFACC9509BEB7A5BF64724B214229E826F72D5EF31DE41C790

Function 0014372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00143774
CoUninitialize.OLE32 ref: 0014377F
CoCreateInstance.OLE32(?,00000000,00000017,0015FB78,?), ref: 001437D9
IIDFromString.OLE32(?,?), ref: 0014384C
VariantInit.OLEAUT32(?), ref: 001438E4
VariantClear.OLEAUT32(?), ref: 00143936

Strings

NULL Pointer assignment, xrefs: 0014381E
Failed to create object, xrefs: 001437E4, 0014389A
Invalid parameter, xrefs: 00143865

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: a2f729999ce0ac02f53c5ed030f86bd5d29dd38925622c5abc9aac32804f275a
Instruction ID: a68b9cca5c21f14b03ff3c3909b64a83985707390734239b18386596a754176e
Opcode Fuzzy Hash: a2f729999ce0ac02f53c5ed030f86bd5d29dd38925622c5abc9aac32804f275a
Instruction Fuzzy Hash: 1E619F70608302AFD311DF54C849F6ABBE4EF48715F10091DF9A59B2A1D770EE49CBA2

Function 00133388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 001333CF

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 001333F0

Strings

^ ERROR , xrefs: 0013349E
Error: , xrefs: 001334D1
"%s" (%d) : ==> %s:, xrefs: 00133522
Incorrect parameters to object property !, xrefs: 001334AB
Line %d (File "%s"):, xrefs: 00133443, 0013345C
"%s" (%d) : ==> %s:%s%s, xrefs: 00133504

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: d7625bdf24d03eb3d78f9f2c8bafcf8052686071f11ab51986899ab46b9fe09d
Instruction ID: 36e924fd50358d9118c302788eddd9b6c2222d9d206992a04a254c8bf0dac739
Opcode Fuzzy Hash: d7625bdf24d03eb3d78f9f2c8bafcf8052686071f11ab51986899ab46b9fe09d
Instruction Fuzzy Hash: EA517C7290020ABADF15EBA0DD46EEEB778AF14340F204169F515720A2EB356F98DF61

Function 0012B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0012B5FC
_wcslen.LIBCMT ref: 0012B608
_wcslen.LIBCMT ref: 0012B64D
_wcslen.LIBCMT ref: 0012B68C
_wcslen.LIBCMT ref: 0012B6C7

Strings

APPEND, xrefs: 0012B6C1, 0012B6C6
EXISTS, xrefs: 0012B686, 0012B68B
REMOVE, xrefs: 0012B602, 0012B607
KEYS, xrefs: 0012B647, 0012B64C

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: b53632d311ad8e95ef8a9045ac252e67e1e1828d94205ee387cd560b13aaa189
Instruction ID: d3bcebea20d4e0d57a056aa1387da062dee46b0589d058004ca93f7bf07b3795
Opcode Fuzzy Hash: b53632d311ad8e95ef8a9045ac252e67e1e1828d94205ee387cd560b13aaa189
Instruction Fuzzy Hash: A241F632A081379BCB206F7DD9D05BE77A5BFA0B54B254229E422EB285F731CD91C790

Function 00135393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 001353A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00135416
GetLastError.KERNEL32 ref: 00135420
SetErrorMode.KERNEL32(00000000,READY), ref: 001354A7

Strings

READY, xrefs: 00135460, 00135468
READONLY, xrefs: 00135452
NOTREADY, xrefs: 0013544B
UNKNOWN, xrefs: 00135444
INVALID, xrefs: 00135459

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 4081636c80a8997c774608b7ae5de75718b1bb8d793b99d4416d7a23f8ebc72c
Instruction ID: 0315036e26ba01cc1ce12fe7910c2a295f220f09759db5f0bde4934cd67933d9
Opcode Fuzzy Hash: 4081636c80a8997c774608b7ae5de75718b1bb8d793b99d4416d7a23f8ebc72c
Instruction Fuzzy Hash: FF318D35A00604DFC718DF68C984FAABBB5EB45715F148069E805DB292EB71DE86CBA0

Function 00153C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00153C79
SetMenu.USER32(?,00000000), ref: 00153C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00153D10
IsMenu.USER32(?), ref: 00153D24
CreatePopupMenu.USER32 ref: 00153D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00153D5B
DrawMenuBar.USER32 ref: 00153D63

Strings

0, xrefs: 00153C54
F, xrefs: 00153D4E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 6772cbe6385cfe6006e3d71b71bc939022e5bd81208c55377085fe4f47a40b1a
Instruction ID: 9f46a3dc4b3be3834a698d122e9fd438318998bec5941e9d471f1785ca7643af
Opcode Fuzzy Hash: 6772cbe6385cfe6006e3d71b71bc939022e5bd81208c55377085fe4f47a40b1a
Instruction Fuzzy Hash: 64415675A01309EFDB14CFA4D844BAA7BB5FF49391F140029ED66AB360D770AA54CF90

Function 00121EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00121F64
GetDlgCtrlID.USER32 ref: 00121F6F
GetParent.USER32 ref: 00121F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00121F8E
GetDlgCtrlID.USER32(?), ref: 00121F97
GetParent.USER32(?), ref: 00121FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00121FAE

Strings

ListBox, xrefs: 00121F21
ComboBox, xrefs: 00121EEC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: aa8f7ef9871606c420abb98dfd607f8b6098e6ac083c8e1d4f139a7c1ee80cc8
Instruction ID: 6b52fd3a0c6a7ee6e3caa7dad738c3022a4dc41338a2a09a1e30f5e4b449cef3
Opcode Fuzzy Hash: aa8f7ef9871606c420abb98dfd607f8b6098e6ac083c8e1d4f139a7c1ee80cc8
Instruction Fuzzy Hash: 7B21C270900224BFCF04EFA0DC85EEEBBB9EF19350B000119F961672D1DB345A68DBA0

Function 00121FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00122043
GetDlgCtrlID.USER32 ref: 0012204E
GetParent.USER32 ref: 0012206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0012206D
GetDlgCtrlID.USER32(?), ref: 00122076
GetParent.USER32(?), ref: 0012208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0012208D

Strings

ListBox, xrefs: 00122002
ComboBox, xrefs: 00121FCD

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: b75bbc703fe5a63fd9046756e3b5374410122494d61ff8033adf45b6b2fb05b0
Instruction ID: 4ce01c5a52e68795f26b9edb8fc0bddad3bde46f4d12dfa3402c7b0f7c397894
Opcode Fuzzy Hash: b75bbc703fe5a63fd9046756e3b5374410122494d61ff8033adf45b6b2fb05b0
Instruction Fuzzy Hash: 5121C271A00214BFCF14AFA0DC85EEEBBB8EF15340F000415F951A72A1CB795A64DB64

Function 00153A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00153A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00153AA0
GetWindowLongW.USER32(?,000000F0), ref: 00153AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00153AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00153B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00153BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00153BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00153BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00153BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00153C13

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 268f5ab9cf9e56b9a3c2797d187ac24cb93fddb279d7ca1405e4db3bb1196884
Instruction ID: 155fd9d9a430ba34d66c5c31a73d9773ebc8ebe6383cab2034a8a8e962f4848e
Opcode Fuzzy Hash: 268f5ab9cf9e56b9a3c2797d187ac24cb93fddb279d7ca1405e4db3bb1196884
Instruction Fuzzy Hash: 03617D75900248EFDB11DF68CC81EEE77B8EB09704F10019AFA25EB291C770AE85DB50

Function 0012B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0012B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B165
GetWindowThreadProcessId.USER32(00000000), ref: 0012B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0012B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B21D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: ce6ce91d7e0a40c5bf98e1defffd55e89edd840974f165ba5ad9ac37fe9e1282
Instruction ID: 1b4a304dbdd65811d61518f5bfa29920f329e0232cb87178a1fbf0754cbc6ab4
Opcode Fuzzy Hash: ce6ce91d7e0a40c5bf98e1defffd55e89edd840974f165ba5ad9ac37fe9e1282
Instruction Fuzzy Hash: FB319C75514314FFDB10DF24EC88B7EBBA9BB51312F144006FA11DA691D7B4AAA0CFA0

Function 000F2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000F2C94

Part of subcall function 000F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0

_free.LIBCMT ref: 000F2CA0
_free.LIBCMT ref: 000F2CAB
_free.LIBCMT ref: 000F2CB6
_free.LIBCMT ref: 000F2CC1
_free.LIBCMT ref: 000F2CCC
_free.LIBCMT ref: 000F2CD7
_free.LIBCMT ref: 000F2CE2
_free.LIBCMT ref: 000F2CED
_free.LIBCMT ref: 000F2CFB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bd737444ddd361eafb8904c17dcadaf450d54171f6ce728c3f809bb29af24c87
Instruction ID: 10e61f7a2a8d8b55aa6a3d7b340f591bd50aa01bd28e6629b71deda7e320edcf
Opcode Fuzzy Hash: bd737444ddd361eafb8904c17dcadaf450d54171f6ce728c3f809bb29af24c87
Instruction Fuzzy Hash: 6711937614410DAFCB02EF94D982CED3BA5FF05350F4144A5FA489BA22DA71EA50AB90

Function 000C1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 000C1459
OleUninitialize.OLE32(?,00000000), ref: 000C14F8
UnregisterHotKey.USER32(?), ref: 000C16DD
DestroyWindow.USER32(?), ref: 001024B9
FreeLibrary.KERNEL32(?), ref: 0010251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0010254B

Strings

close all, xrefs: 000C1454

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: a22379cd9fdf7bd70f3e258dcbbb44964012a09503ef46261715b305eb32df07
Instruction ID: 69568ff0d45a32e05222bfa901ecd9196ce48dd209dfc150f9f58caf9732078f
Opcode Fuzzy Hash: a22379cd9fdf7bd70f3e258dcbbb44964012a09503ef46261715b305eb32df07
Instruction Fuzzy Hash: 0ED13B31601212CFCB29EF14C899FADF7A5BF05700F14429DE84A6B292DB71AD16CF94

Function 00137DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00137FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00137FC1
GetFileAttributesW.KERNEL32(?), ref: 00137FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00138005
SetCurrentDirectoryW.KERNEL32(?), ref: 00138017
SetCurrentDirectoryW.KERNEL32(?), ref: 00138060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 001380B0

Strings

*.*, xrefs: 00138066

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 3aa8a67563a28bfec3a95843d664c577d7d17868bcc2e2966dfca9f17ec31fdb
Instruction ID: d3cfabf06bea43877c9611cab75aa950619295a45d52e43f727a5da45fda1ec4
Opcode Fuzzy Hash: 3aa8a67563a28bfec3a95843d664c577d7d17868bcc2e2966dfca9f17ec31fdb
Instruction Fuzzy Hash: A68180B15083459FCB34EF14C484AAEB3E8BB89310F544C6EF889D7291EB74DD498B52

Function 000C5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 000C5C7A

Part of subcall function 000C5D0A: GetClientRect.USER32(?,?), ref: 000C5D30
Part of subcall function 000C5D0A: GetWindowRect.USER32(?,?), ref: 000C5D71
Part of subcall function 000C5D0A: ScreenToClient.USER32(?,?), ref: 000C5D99

GetDC.USER32 ref: 001046F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00104708
SelectObject.GDI32(00000000,00000000), ref: 00104716
SelectObject.GDI32(00000000,00000000), ref: 0010472B
ReleaseDC.USER32(?,00000000), ref: 00104733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 001047C4

Strings

U, xrefs: 00104693

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 4bd74b04e1735c21dde96b2305793324002a569f7d5696791369e657fce9907e
Instruction ID: ed9c3d65080ecc21a18956f814609104b622abf71877b90327dd0a5af63a33c7
Opcode Fuzzy Hash: 4bd74b04e1735c21dde96b2305793324002a569f7d5696791369e657fce9907e
Instruction Fuzzy Hash: A971DCB5400205EFCF258F64C9C4AAE3BB1FF4A361F14426AEE955A2A6D3719881DF60

Function 0013359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 001335E4

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

LoadStringW.USER32(00192390,?,00000FFF,?), ref: 0013360A

Strings

"%s" (%d) : ==> %s:, xrefs: 00133742
Error: , xrefs: 001336EF
^ ERROR, xrefs: 001336C9
Line %d (File "%s"):, xrefs: 0013366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00133724

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 3cf32a8d224621c449c704d7da43d98ca99db6ff6ae664f0b0dcbda6f683f473
Instruction ID: 97258a77b6899eb3afcdadafcdfaf3260ebad47467ced5a418a91b5238550aae
Opcode Fuzzy Hash: 3cf32a8d224621c449c704d7da43d98ca99db6ff6ae664f0b0dcbda6f683f473
Instruction Fuzzy Hash: 59518C7190020ABBDF14EBA0DC46EEEBB38EF14310F144129F515721A2EB311B99DFA5

Function 0013C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0013C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0013C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0013C2CA
GetLastError.KERNEL32 ref: 0013C322
SetEvent.KERNEL32(?), ref: 0013C336
InternetCloseHandle.WININET(00000000), ref: 0013C341

Strings

, xrefs: 0013C2BB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: f79b2d60727768b4f87db2701d24218ccc4097968cbfe0bd547a4f1f18c1a9c9
Instruction ID: 846196c0a4b16945b09b7f847e2c5e67bb288682ba752bb066b08fb4231971ea
Opcode Fuzzy Hash: f79b2d60727768b4f87db2701d24218ccc4097968cbfe0bd547a4f1f18c1a9c9
Instruction Fuzzy Hash: 273167B1600708AFD7219FA4DC88AAB7BFCFB59744F14851EF486A6600DB30ED459BA1

Function 0012989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00103AAF,?,?,Bad directive syntax error,0015CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 001298BC
LoadStringW.USER32(00000000,?,00103AAF,?), ref: 001298C3

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00129987

Strings

., xrefs: 0012996D
%s (%d) : ==> %s.: %s %s, xrefs: 001298F1
Line %d (File "%s"):, xrefs: 0012992D
Line %d:, xrefs: 00129912
Error: , xrefs: 00129955

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 417703a22943a33b040bdbd1bad8fbadbf98e5bd99b999850c2ebfc99ba43ba7
Instruction ID: b52d75b8fb4f9e480e476e349ce8621b6a51e4b50ab61e978a96b90c76079f78
Opcode Fuzzy Hash: 417703a22943a33b040bdbd1bad8fbadbf98e5bd99b999850c2ebfc99ba43ba7
Instruction Fuzzy Hash: 95217A3290031AEBCF15AF90DC4AEEE7739BF18304F04446AF515660A2EB719A68CB60

Function 0012209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 001220AB
GetClassNameW.USER32(00000000,?,00000100), ref: 001220C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0012214D

Strings

smallicons, xrefs: 00122115
SHELLDLL_DefView, xrefs: 001220CC
largeicons, xrefs: 001220E1
details, xrefs: 001220FB
list, xrefs: 0012212F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: c5d9cda3c2ff0f80a7b91dee083709a3e5694dcf5044125fc412c7498b283899
Instruction ID: 1b0a663158db1bec42ec69730e131653b2be9d2aff3c0a4a2ba5d1fc86c43f36
Opcode Fuzzy Hash: c5d9cda3c2ff0f80a7b91dee083709a3e5694dcf5044125fc412c7498b283899
Instruction Fuzzy Hash: FC11367A688316BEF7053620FC06CEA379DCF15324B200026FB04B80E2FFB169715A18

Function 000F8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec8ee899dee97235725bf44d8dcb8f850b44b6e7ac0465fc1b90593e07ca45a
Instruction ID: f4620254c9cda82750f10020c4ea78bdfd56a5575b2e9d3cc398cde1e1b3ec0a
Opcode Fuzzy Hash: 0ec8ee899dee97235725bf44d8dcb8f850b44b6e7ac0465fc1b90593e07ca45a
Instruction Fuzzy Hash: 84C1F175A0434DAFCB61DFA9D841BFDBBF0AF09310F044099EA14A7792CB359941EB60

Function 000FCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 000FCEB7
_free.LIBCMT ref: 000FCF22
_free.LIBCMT ref: 000FCF48
_free.LIBCMT ref: 000FCF71
_free.LIBCMT ref: 000FCFA9
_free.LIBCMT ref: 000FCFDA
_free.LIBCMT ref: 000FD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 000FD09C
_free.LIBCMT ref: 000FD0B5

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 49fb3fce1d8dd3d4cfccf0082bd8c12ac707508622923e42b5e2ed8f12e18c7f
Instruction ID: 096757201bcd504dbe08e805e8524526ce3ad8ea3be0b5c119f375e88a999b69
Opcode Fuzzy Hash: 49fb3fce1d8dd3d4cfccf0082bd8c12ac707508622923e42b5e2ed8f12e18c7f
Instruction Fuzzy Hash: ED61587190430DAFEB21AFB49942ABDBBE5EF05310F04017EFB4597A82DB319E05A790

Function 001550D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00155186
ShowWindow.USER32(?,00000000), ref: 001551C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 001551CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 001551D1

Part of subcall function 00156FBA: DeleteObject.GDI32(00000000), ref: 00156FE6

GetWindowLongW.USER32(?,000000F0), ref: 0015520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0015521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0015524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00155287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00155296

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 1f6a4373d65ae7faadea8daf00e39b5ba6bc2a6ffb65e487bdd970dd852fba1f
Instruction ID: 2be3f9921045e0ee7d05fa634d7f8eeca7b28cfd13fe4134e44494d41bdaf0e8
Opcode Fuzzy Hash: 1f6a4373d65ae7faadea8daf00e39b5ba6bc2a6ffb65e487bdd970dd852fba1f
Instruction Fuzzy Hash: 7F519330A50A08FEEF249F24CC95BD83BA6EB05366F144012FD359E6E1C775A988DB51

Function 000D8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00116890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 001168A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 001168B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 001168D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 001168F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,000D8874,00000000,00000000,00000000,000000FF,00000000), ref: 00116901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0011691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,000D8874,00000000,00000000,00000000,000000FF,00000000), ref: 0011692D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: df8e03b2a282dd3cbc9a2629144c1a87732eb658ef22cce2bd744cb5aab1db4c
Instruction ID: 05a86f7bd44232ac5bda3e038f24a77ce8073ae15134c40ea2819405fedb60e2
Opcode Fuzzy Hash: df8e03b2a282dd3cbc9a2629144c1a87732eb658ef22cce2bd744cb5aab1db4c
Instruction Fuzzy Hash: CD51AD70600309EFDB24CF24CC95FAA7BB5FB58365F10452AF9129B2A0DB71E990DB60

Function 0013C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0013C182
GetLastError.KERNEL32 ref: 0013C195
SetEvent.KERNEL32(?), ref: 0013C1A9

Part of subcall function 0013C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0013C272
Part of subcall function 0013C253: GetLastError.KERNEL32 ref: 0013C322
Part of subcall function 0013C253: SetEvent.KERNEL32(?), ref: 0013C336
Part of subcall function 0013C253: InternetCloseHandle.WININET(00000000), ref: 0013C341

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: e92734f7963f5c3ee264b2a13b4f0023b1ac7c63df8147b1bb7e6666b3d9fde0
Instruction ID: 91cd3892d9de3af1224d18c596258b5aa7596f2fe483bc1b95dca5771195e1d3
Opcode Fuzzy Hash: e92734f7963f5c3ee264b2a13b4f0023b1ac7c63df8147b1bb7e6666b3d9fde0
Instruction Fuzzy Hash: DD315571200705EFDB219FA5DC44A6BBBE9FF28301F04442DF956AAA10D730E854ABE0

Function 001225A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00123A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00123A57
Part of subcall function 00123A3D: GetCurrentThreadId.KERNEL32 ref: 00123A5E
Part of subcall function 00123A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001225B3), ref: 00123A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 001225BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 001225DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 001225DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 001225E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00122601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00122605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0012260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00122623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00122627

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: c063b1bfe7626b3168496e279a520b2bb8aa5c3fcbd659550e495a7a0f875562
Instruction ID: 5238e2bbca56fa7482d1b51a506223c2399eed1995a5425b821074dc0de9b0de
Opcode Fuzzy Hash: c063b1bfe7626b3168496e279a520b2bb8aa5c3fcbd659550e495a7a0f875562
Instruction Fuzzy Hash: F301D831390720FBFB106B689CCAF993F99DB5EB12F100011F314AF1D1CAF114948AA9

Function 00121803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00121449,?,?,00000000), ref: 0012180C
HeapAlloc.KERNEL32(00000000,?,00121449,?,?,00000000), ref: 00121813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00121449,?,?,00000000), ref: 00121828
GetCurrentProcess.KERNEL32(?,00000000,?,00121449,?,?,00000000), ref: 00121830
DuplicateHandle.KERNEL32(00000000,?,00121449,?,?,00000000), ref: 00121833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00121449,?,?,00000000), ref: 00121843
GetCurrentProcess.KERNEL32(00121449,00000000,?,00121449,?,?,00000000), ref: 0012184B
DuplicateHandle.KERNEL32(00000000,?,00121449,?,?,00000000), ref: 0012184E
CreateThread.KERNEL32(00000000,00000000,00121874,00000000,00000000,00000000), ref: 00121868

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 25717365dbf7c1601a03762abf0a4181ec91d930a971a04beac4b5bf82f0651b
Instruction ID: f4f62a5016e28510474150d323d7d553f30869cbc9a08aca43b4ff09b47cb344
Opcode Fuzzy Hash: 25717365dbf7c1601a03762abf0a4181ec91d930a971a04beac4b5bf82f0651b
Instruction Fuzzy Hash: 6101A8B5640708FFE610AFA5DC89F6B3BACEB89B11F004411FA05DB5A1CA709850CB60

Function 0014A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0012D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0012D501
Part of subcall function 0012D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0012D50F
Part of subcall function 0012D4DC: CloseHandle.KERNEL32(00000000), ref: 0012D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0014A16D
GetLastError.KERNEL32 ref: 0014A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0014A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0014A268
GetLastError.KERNEL32(00000000), ref: 0014A273
CloseHandle.KERNEL32(00000000), ref: 0014A2C4

Strings

SeDebugPrivilege, xrefs: 0014A18F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: cb38db089c160fd5f465efa91450190b289bbdeee04e239c8942e7f7648d5476
Instruction ID: 1991ec38b69463bdb303b94b8df2ed44868bb0e79c72d88fbd54574294b1d95a
Opcode Fuzzy Hash: cb38db089c160fd5f465efa91450190b289bbdeee04e239c8942e7f7648d5476
Instruction Fuzzy Hash: EF61A1302442429FD720DF14C494F5ABBE1AF54318F55849CE45A4FBA3C7B2ED46DB92

Function 00153886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00153925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0015393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00153954
_wcslen.LIBCMT ref: 00153999
SendMessageW.USER32(?,00001057,00000000,?), ref: 001539C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 001539F4

Strings

SysListView32, xrefs: 001538F7

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 0d2d96f27d0f82b0ef350d357f893c2f1667ff1ac025cef0f65e3cac37043045
Instruction ID: 3a6734ca8262f1d2ed308ce464a18402a90e447581a6f4bbd291f97a8967ccf7
Opcode Fuzzy Hash: 0d2d96f27d0f82b0ef350d357f893c2f1667ff1ac025cef0f65e3cac37043045
Instruction Fuzzy Hash: 9E417571A00319EFEF259F64CC49BEA77A9EF08395F100526F964EB281D7719A84CB90

Function 0012BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0012BCFD
IsMenu.USER32(00000000), ref: 0012BD1D
CreatePopupMenu.USER32 ref: 0012BD53
GetMenuItemCount.USER32(00DC55F0), ref: 0012BDA4
InsertMenuItemW.USER32(00DC55F0,?,00000001,00000030), ref: 0012BDCC

Strings

2, xrefs: 0012BD37
0, xrefs: 0012BCA8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 5d756c6dc87960146e066497a85d9ef1b239bf75c9ecfb182502c871ed741ec9
Instruction ID: 358162839800437becc528399c11af99555505faf420b107be65c636df597a3c
Opcode Fuzzy Hash: 5d756c6dc87960146e066497a85d9ef1b239bf75c9ecfb182502c871ed741ec9
Instruction Fuzzy Hash: 6751BE70A08329DBDB14CFE8E8C4BEEBBF4AF55318F148119E4519B291E7709961CB91

Function 0012C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0012C913

Strings

stop, xrefs: 0012C8E4
warning, xrefs: 0012C8FC
question, xrefs: 0012C8CC
blank, xrefs: 0012C895
info, xrefs: 0012C8B4

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 8538c6b751da78a53ab26b6986da8a43e8126dd480e837a77e403de60b234f5b
Instruction ID: 778f995ddd844a5860f66f27ba50125c1bda71767bbf062825a6b27a47645c7d
Opcode Fuzzy Hash: 8538c6b751da78a53ab26b6986da8a43e8126dd480e837a77e403de60b234f5b
Instruction Fuzzy Hash: C2112B31689316BEEB046B54EC83CEE379CDF15328B10003EF700A6182E7E05E5057E9

Function 0012DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0012DE42
gethostname.WSOCK32(?,00000100), ref: 0012DE5C
gethostbyname.WSOCK32(?), ref: 0012DE69
inet_ntoa.WSOCK32(?), ref: 0012DEAB
_strcat.LIBCMT ref: 0012DEB9
WSACleanup.WSOCK32 ref: 0012DEDE

Strings

0.0.0.0, xrefs: 0012DE87

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 512a6d369a031985961c105dcb8671556d8bdd5d6f3c0ff23cc96b98076e7406
Instruction ID: 47812cca35bcafcb028ed85f54bf3c3a7e9909d4bf1d161a0f6da0069eb46505
Opcode Fuzzy Hash: 512a6d369a031985961c105dcb8671556d8bdd5d6f3c0ff23cc96b98076e7406
Instruction Fuzzy Hash: 33110A71504315AFDB24AF60FC0ADEE77ACDF15711F020169F445AA092EF718AC18AA0

Function 00159F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2

GetSystemMetrics.USER32(0000000F), ref: 00159FC7
GetSystemMetrics.USER32(0000000F), ref: 00159FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0015A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0015A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0015A263
ShowWindow.USER32(00000003,00000000), ref: 0015A282
InvalidateRect.USER32(?,00000000,00000001), ref: 0015A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 0015A2CA

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 8993da2a4a8f90d757042bf1ae5c32c575604b73d5b086cb06960c1ed53ad50b
Instruction ID: 637c69a3dfb25ca08ca48080eb6e50d06af7ce28b39e136525cd768b43203a01
Opcode Fuzzy Hash: 8993da2a4a8f90d757042bf1ae5c32c575604b73d5b086cb06960c1ed53ad50b
Instruction Fuzzy Hash: 15B1B931640219EFCF14CF68C9C57AA3BB2BF48702F488169ECA59F295D731A984CB51

Function 0012ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0012ED2A
_wcslen.LIBCMT ref: 0012ED3B
_wcslen.LIBCMT ref: 0012ED79
_wcslen.LIBCMT ref: 0012EDAF
_wcslen.LIBCMT ref: 0012EDDF
_wcslen.LIBCMT ref: 0012EDEF
_wcslen.LIBCMT ref: 0012EE2B
_wcslen.LIBCMT ref: 0012EE5A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 603063719d66416ba8c44ac90524bf28eea8685f6f07173cef914686b8cffd58
Instruction ID: 963cfaae5ed4a3639e7813f67bf5cb50e9ddf7933afac642a05a5ed9a44d2e86
Opcode Fuzzy Hash: 603063719d66416ba8c44ac90524bf28eea8685f6f07173cef914686b8cffd58
Instruction Fuzzy Hash: CC41A065C1026879CB11EBF5988A9CFB7A8AF45310F518466E618F3123FB34E255C3E6

Function 000DF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0011682C,00000004,00000000,00000000), ref: 000DF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0011682C,00000004,00000000,00000000), ref: 0011F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0011682C,00000004,00000000,00000000), ref: 0011F454

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: b799a95c609f48f6772fb42368679f9a777a42b9a793b1cff0db28c97ff0908f
Instruction ID: 93c2a7e17507d82b741b8280daab1e168e4b731a529cda5cafac9e8a7e8d58e1
Opcode Fuzzy Hash: b799a95c609f48f6772fb42368679f9a777a42b9a793b1cff0db28c97ff0908f
Instruction Fuzzy Hash: BB410830A18782BEC7799F2988A877ABAD2BB56314F14C03EE05796B61D73198C1C771

Function 00152D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00152D1B
GetDC.USER32(00000000), ref: 00152D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00152D2E
ReleaseDC.USER32(00000000,00000000), ref: 00152D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00152D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00152D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00155A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00152DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00152DE1

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 5f648900b2d9542f8eb0846feadb6ffa097d7874e65c8ac19d021933f44189f2
Instruction ID: 13a4eb7a97b2d39ffd6d2766b3332759e6cca400fe7f9219a6cc118c5c7b05bc
Opcode Fuzzy Hash: 5f648900b2d9542f8eb0846feadb6ffa097d7874e65c8ac19d021933f44189f2
Instruction Fuzzy Hash: BA316B76201314BFEB118F50DC8AFEB3BA9EB0A716F044055FE089E291C6759C90CBA4

Function 00125622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00125637
_memcmp.LIBVCRUNTIME ref: 00125659
_memcmp.LIBVCRUNTIME ref: 00125671
_memcmp.LIBVCRUNTIME ref: 00125684
_memcmp.LIBVCRUNTIME ref: 0012569E
_memcmp.LIBVCRUNTIME ref: 001256B1
_memcmp.LIBVCRUNTIME ref: 001256C9
_memcmp.LIBVCRUNTIME ref: 001256E4

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 252e04f149c8be5bfdd42ded95327a202b5cb28326f7fef45b61312b40e6e601
Instruction ID: 8e50aa856a7f87f65c8d821ebcbad64cd829a5eb0e8da2db773df015ada695c9
Opcode Fuzzy Hash: 252e04f149c8be5bfdd42ded95327a202b5cb28326f7fef45b61312b40e6e601
Instruction Fuzzy Hash: 8D21C571A41A69BFD3189521AEC2FFB335EAF60385F440034FD04AA582F770EE2581A5

Function 00144FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0014502E, 00145383
Not an Object type, xrefs: 00145007

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 338a4dd03c0e65eacb8422dd476dededc6fa5e0da16b1131c223601dbd0dc894
Instruction ID: 161d618f11385ace130256a57af93d08e949ca7e86c034dfb39ef538a4240264
Opcode Fuzzy Hash: 338a4dd03c0e65eacb8422dd476dededc6fa5e0da16b1131c223601dbd0dc894
Instruction Fuzzy Hash: 7CD1B175A0060AAFDF14CFA8C881FAEB7B6BF48344F148169F915AB292D770DD45CB90

Function 00101522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 001015CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00101651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001016E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 001016FB

Part of subcall function 000F3820: RtlAllocateHeap.NTDLL(00000000,?,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6,?,000C1129), ref: 000F3852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00101777
__freea.LIBCMT ref: 001017A2
__freea.LIBCMT ref: 001017AE

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 90bfda338b1ba8e6eaa45d6083ba38386e030a2d4301080a893419cf339ac5a6
Instruction ID: f8be285625cee7443e95183db45a9465af8db08009a14df5df5d36f5144d9a75
Opcode Fuzzy Hash: 90bfda338b1ba8e6eaa45d6083ba38386e030a2d4301080a893419cf339ac5a6
Instruction Fuzzy Hash: 8391B872E00216BEDB248EB4CC81AFE7BB5AF49710F184659E941EB1C1DBB9DD40CB60

Function 00144523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00144648
VariantInit.OLEAUT32(?), ref: 00144749
VariantClear.OLEAUT32(?), ref: 00144753
VariantClear.OLEAUT32(?), ref: 001447B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0014472C
Null Object assignment in FOR..IN loop, xrefs: 001445D8, 00144706, 001447BE

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 5bd330fcaa95de77449a6084560111fb972bf62c17ec4c3f3c3dd2a68532ca83
Instruction ID: ec64ac9a27f8e10f4ca013c4686039c73c99d06a22362a9447157b3e7a5b21ed
Opcode Fuzzy Hash: 5bd330fcaa95de77449a6084560111fb972bf62c17ec4c3f3c3dd2a68532ca83
Instruction Fuzzy Hash: 9C91AC71A00219EFDF24CFA4C888FAEBBB8EF46715F108559F515AB291D7709942CFA0

Function 00131187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0013125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00131284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 001312A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 001312D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0013135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 001313C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00131430

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: e03f07e99b2745e49016166a7c23cea1dd062738981aff7103e07adbfd92cfc0
Instruction ID: 6a86d7165b7cd48fc157f423cb8ae9082e80987363798c1e62f61fbfdbe9b6fc
Opcode Fuzzy Hash: e03f07e99b2745e49016166a7c23cea1dd062738981aff7103e07adbfd92cfc0
Instruction Fuzzy Hash: 8991F472A00309AFEB00DFA4C894BFEB7B5FF44325F214029E911EB292D774A941CB90

Function 000D948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 58c9497992c06d74d0e1b9618d40dd3a3376b85374c1c8acdd62b8e597798724
Instruction ID: a0a61dfe4b63d4b5cff9ce9aed77343e10b9d2119dc72a63d0b34f243fd8ffac
Opcode Fuzzy Hash: 58c9497992c06d74d0e1b9618d40dd3a3376b85374c1c8acdd62b8e597798724
Instruction Fuzzy Hash: A9911571900219EFCB15CFA9C884AEEBBB8FF49320F144556E515B7295D374AA82CBA0

Function 00143947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0014396B
CharUpperBuffW.USER32(?,?), ref: 00143A7A
_wcslen.LIBCMT ref: 00143A8A
VariantClear.OLEAUT32(?), ref: 00143C1F

Part of subcall function 00130CDF: VariantInit.OLEAUT32(00000000), ref: 00130D1F
Part of subcall function 00130CDF: VariantCopy.OLEAUT32(?,?), ref: 00130D28
Part of subcall function 00130CDF: VariantClear.OLEAUT32(?), ref: 00130D34

Strings

Incorrect Parameter format, xrefs: 001439A6, 00143BA1
AUTOIT.ERROR, xrefs: 00143A80, 00143A85

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: ab5ebf279916ea63ba4ebdf3e6bfb86f9b80b0388ff5a6a3963f9db870acc4e0
Instruction ID: a5eeabbf296c99287b7b7f102e4a67b3c506a2c4bbbdad69c5b7c0342d22ff80
Opcode Fuzzy Hash: ab5ebf279916ea63ba4ebdf3e6bfb86f9b80b0388ff5a6a3963f9db870acc4e0
Instruction Fuzzy Hash: C59149756083059FC704EF24C48596AB7E5FF89314F14892EF89A9B362DB30EE45CB92

Function 00144BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0012000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?,?,0012035E), ref: 0012002B
Part of subcall function 0012000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?), ref: 00120046
Part of subcall function 0012000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?), ref: 00120054
Part of subcall function 0012000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?), ref: 00120064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00144C51
_wcslen.LIBCMT ref: 00144D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00144DCF
CoTaskMemFree.OLE32(?), ref: 00144DDA

Strings

NULL Pointer assignment, xrefs: 00144E23, 00144E52

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 124258f990786b5006f0789320414b35a9d1bd627235b333dd6d02f767384380
Instruction ID: baa187ed3fcc7da20255eaa633f5c4631003cac80c956213d8170fe21f57eca3
Opcode Fuzzy Hash: 124258f990786b5006f0789320414b35a9d1bd627235b333dd6d02f767384380
Instruction Fuzzy Hash: 1D910471D0021DAFDF14DFA4D891EEEB7B9BF08314F108169E915BB291EB349A458FA0

Function 001520FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00152183
GetMenuItemCount.USER32(00000000), ref: 001521B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 001521DD
_wcslen.LIBCMT ref: 00152213
GetMenuItemID.USER32(?,?), ref: 0015224D
GetSubMenu.USER32(?,?), ref: 0015225B

Part of subcall function 00123A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00123A57
Part of subcall function 00123A3D: GetCurrentThreadId.KERNEL32 ref: 00123A5E
Part of subcall function 00123A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001225B3), ref: 00123A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 001522E3

Part of subcall function 0012E97B: Sleep.KERNELBASE ref: 0012E9F3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 84071305f3cdf67f4cad5a47aaf45f66b8206d26bdb7439a82278f707389ddec
Instruction ID: 936fcd5311247ee3161152232bd2fca4a8e1c0ca32aefea7a3efc42b8a3b7d82
Opcode Fuzzy Hash: 84071305f3cdf67f4cad5a47aaf45f66b8206d26bdb7439a82278f707389ddec
Instruction Fuzzy Hash: E8718176A00205EFCB14DF64C885AAEB7F1EF49311F158469E826EF341D774EE458B90

Function 00157E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00DC56B8), ref: 00157F37
IsWindowEnabled.USER32(00DC56B8), ref: 00157F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0015801E
SendMessageW.USER32(00DC56B8,000000B0,?,?), ref: 00158051
IsDlgButtonChecked.USER32(?,?), ref: 00158089
GetWindowLongW.USER32(00DC56B8,000000EC), ref: 001580AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 001580C3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: e53bc1c8cb7f769d0be4e42132c1565f2a2bfcbca801c2d996879b04ccea881e
Instruction ID: b8aee364c35e89f2ae94ea237e0ef80fcf8f08cd9c715499b7eeec704f03b503
Opcode Fuzzy Hash: e53bc1c8cb7f769d0be4e42132c1565f2a2bfcbca801c2d996879b04ccea881e
Instruction Fuzzy Hash: C7718D34608204EFEB21DF54D886FEA7BB5EF09302F14045AFD759B2A1CB31A988CB50

Function 0012AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0012AEF9
GetKeyboardState.USER32(?), ref: 0012AF0E
SetKeyboardState.USER32(?), ref: 0012AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0012AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0012AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0012AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0012B020

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 044b760c130b1c9da1712c7539e926b8e23d7212e9389633e10eba8a27f3057f
Instruction ID: 668bd037bc214fadaef956dffbe724aedf795881648c6070fc9e3d064966e660
Opcode Fuzzy Hash: 044b760c130b1c9da1712c7539e926b8e23d7212e9389633e10eba8a27f3057f
Instruction Fuzzy Hash: B851D3A06087E53EFB3742349D45BBABFE95F06304F088589F2E9958C2D398ACE4D751

Function 0012ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0012AD19
GetKeyboardState.USER32(?), ref: 0012AD2E
SetKeyboardState.USER32(?), ref: 0012AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0012ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0012ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0012AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0012AE38

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 5d41d95becc887495fd85e120e48dfae792844b4aefc9e47c6b9e7a1bb461574
Instruction ID: 2690a2b1d71472dd989c9426b568d13c8089910add7ab7ee1289065eb8ffeb28
Opcode Fuzzy Hash: 5d41d95becc887495fd85e120e48dfae792844b4aefc9e47c6b9e7a1bb461574
Instruction Fuzzy Hash: 865116A05087E53EFB3683749C95B7ABEA85F05300F488488E1D5468C3D394ECA4D352

Function 000F542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00103CD6,?,?,?,?,?,?,?,?,000F5BA3,?,?,00103CD6,?,?), ref: 000F5470
__fassign.LIBCMT ref: 000F54EB
__fassign.LIBCMT ref: 000F5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00103CD6,00000005,00000000,00000000), ref: 000F552C
WriteFile.KERNEL32(?,00103CD6,00000000,000F5BA3,00000000,?,?,?,?,?,?,?,?,?,000F5BA3,?), ref: 000F554B
WriteFile.KERNEL32(?,?,00000001,000F5BA3,00000000,?,?,?,?,?,?,?,?,?,000F5BA3,?), ref: 000F5584

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 78e7a72796f5a7db176ed3f702ec89f072a77de78797331b14a0c5eafc5c19a8
Instruction ID: 3048e01e5ca1c9f96a3417db456f294170786604d621d840916531a00690361f
Opcode Fuzzy Hash: 78e7a72796f5a7db176ed3f702ec89f072a77de78797331b14a0c5eafc5c19a8
Instruction Fuzzy Hash: DE51D171A00B099FDB11CFA8DC95AEEBBF9EF08701F14411AF655E7691D730AA41CBA0

Function 000E2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 000E2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 000E2D53
_ValidateLocalCookies.LIBCMT ref: 000E2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 000E2E0C
_ValidateLocalCookies.LIBCMT ref: 000E2E61

Strings

csm, xrefs: 000E2DF6

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1b96fd6f2f419f7aa969869e582ae4f19208ffd7e4cd15e9d371f172b1570e76
Instruction ID: af7009df11dc28df686a8fba2a795a7f3e8c3dd7d002afd457df0cd797841db5
Opcode Fuzzy Hash: 1b96fd6f2f419f7aa969869e582ae4f19208ffd7e4cd15e9d371f172b1570e76
Instruction Fuzzy Hash: 6341A035A04289AFCF10DF6ACC45ADEBBB9BF44324F148155E914BB392D771AA41CBD0

Function 001410B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0014304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0014307A
Part of subcall function 0014304E: _wcslen.LIBCMT ref: 0014309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00141112
WSAGetLastError.WSOCK32 ref: 00141121
WSAGetLastError.WSOCK32 ref: 001411C9
closesocket.WSOCK32(00000000), ref: 001411F9

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 5eb964c868e7ef4b44d24d99f227c9f7ccecbd4d4730c02141b6f6391b0d1d44
Instruction ID: 6c596987b9b1539883a633ba33ec0d8346ffacdf1924ff8921597c5026ee1ae4
Opcode Fuzzy Hash: 5eb964c868e7ef4b44d24d99f227c9f7ccecbd4d4730c02141b6f6391b0d1d44
Instruction Fuzzy Hash: E741D431600604AFDB109F24C885BA9BBE9EF45765F148069FD199F2A2D770AD81CBE1

Function 0012CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0012DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0012CF22,?), ref: 0012DDFD

Part of subcall function 0012DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0012CF22,?), ref: 0012DE16

lstrcmpiW.KERNEL32(?,?), ref: 0012CF45
MoveFileW.KERNEL32(?,?), ref: 0012CF7F
_wcslen.LIBCMT ref: 0012D005
_wcslen.LIBCMT ref: 0012D01B
SHFileOperationW.SHELL32(?), ref: 0012D061

Strings

\*.*, xrefs: 0012CFF3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: d3057fc7fad48b6a545a4907b12d3bdd02214f6bf0fb4aaa5ed399fd81330b19
Instruction ID: a9dc0f05ac89c7189675b353ac249182715ddd9c877ba556f4baff35c5a5ac70
Opcode Fuzzy Hash: d3057fc7fad48b6a545a4907b12d3bdd02214f6bf0fb4aaa5ed399fd81330b19
Instruction Fuzzy Hash: 154139719452299FDF12EFA4EA81EDD77F9AF18340F1000E6E645EB142EB34A794CB50

Function 00152DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00152E1C
GetWindowLongW.USER32(?,000000F0), ref: 00152E4F
GetWindowLongW.USER32(?,000000F0), ref: 00152E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00152EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00152EE0
GetWindowLongW.USER32(?,000000F0), ref: 00152EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00152F0B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 6f7c54423381fd2a4aa3785af95d3c23092b04b54e0cfdb9fcddc9cb364c9ad1
Instruction ID: cb3d0e8f9bf0489908b66315e480422ab10c483ba5b40510b4002791d308e958
Opcode Fuzzy Hash: 6f7c54423381fd2a4aa3785af95d3c23092b04b54e0cfdb9fcddc9cb364c9ad1
Instruction Fuzzy Hash: F3310332604251EFDB21CF58EC86FA537E1EB9A716F150165F9208F6B1CB71A884DB41

Function 00127726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00127769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0012778F
SysAllocString.OLEAUT32(00000000), ref: 00127792
SysAllocString.OLEAUT32(?), ref: 001277B0
SysFreeString.OLEAUT32(?), ref: 001277B9
StringFromGUID2.OLE32(?,?,00000028), ref: 001277DE
SysAllocString.OLEAUT32(?), ref: 001277EC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: db7ce2fa7bf844f1be21f9dcf31835da96c518bb5bcfe70b3a2d01f5aad1913c
Instruction ID: 4ddc2cfd5814d5ee38cedaf068ddf658eb88066009213ccb1234a5616badc4ba
Opcode Fuzzy Hash: db7ce2fa7bf844f1be21f9dcf31835da96c518bb5bcfe70b3a2d01f5aad1913c
Instruction Fuzzy Hash: 37219076604329AFDB10EFA8DC88CBB77ACEB097647048425FA15DB291D770DC8187A0

Function 001277FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00127842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00127868
SysAllocString.OLEAUT32(00000000), ref: 0012786B
SysAllocString.OLEAUT32 ref: 0012788C
SysFreeString.OLEAUT32 ref: 00127895
StringFromGUID2.OLE32(?,?,00000028), ref: 001278AF
SysAllocString.OLEAUT32(?), ref: 001278BD

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 911df63096d7fa9707d6945ed46007ed63ce2683af08ff297f29e361f45840aa
Instruction ID: f2ac9fa84040c262c73329a76ec2b18a8b094b4640c963bbdcdd0ddd77bc8c56
Opcode Fuzzy Hash: 911df63096d7fa9707d6945ed46007ed63ce2683af08ff297f29e361f45840aa
Instruction Fuzzy Hash: 17215E35608324EF9B149FA9EC88DBB77ECEB097607108125B915CB2A1EB70DC91CB64

Function 001304D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 001304F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0013052E

Strings

nul, xrefs: 00130567

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 26faac6b26199f791f29c9d8a9e43665b73130be0b16de393a48e719232af554
Instruction ID: a29fdd237d1c634576f10ba25353e571f5e09643214323a0854b3d1db24c47bf
Opcode Fuzzy Hash: 26faac6b26199f791f29c9d8a9e43665b73130be0b16de393a48e719232af554
Instruction Fuzzy Hash: A3216975600305EFDB219F29DC54A9A7BE4BF49724F204A19F8A1E72E0E7709980CF60

Function 001305A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 001305C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00130601

Strings

nul, xrefs: 00130639

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 229484b413e76c7b237600f3efc7b1344ec7a4393b7a41b3b59423d1f7bb0d51
Instruction ID: 155ae74feca98e453800ce45ff7101bff5b3f2ddf1ec756d9bc72578fef147db
Opcode Fuzzy Hash: 229484b413e76c7b237600f3efc7b1344ec7a4393b7a41b3b59423d1f7bb0d51
Instruction Fuzzy Hash: 8E21B6B5500305DFDB219F69CC55A9A77E8BF99B30F200B19F8A1E72E4E77099A0CB50

Function 001540AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000C604C
Part of subcall function 000C600E: GetStockObject.GDI32(00000011), ref: 000C6060
Part of subcall function 000C600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 000C606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00154112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0015411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0015412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00154139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00154145

Strings

Msctls_Progress32, xrefs: 001540E3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 44b9338130ac7a3dad3041d40d04b5be3ff0d407451e54c7182dbd6684c95f1d
Instruction ID: 7fa1a342841da37fea852ef565ae46693d5c9ecf4c18ad3c6412427958ec7553
Opcode Fuzzy Hash: 44b9338130ac7a3dad3041d40d04b5be3ff0d407451e54c7182dbd6684c95f1d
Instruction Fuzzy Hash: 8711B2B2140219BFEF119F64CC85EE77F9DEF18798F114111BA28A6190C772DC61DBA4

Function 000FD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000FD7A3: _free.LIBCMT ref: 000FD7CC

_free.LIBCMT ref: 000FD82D

Part of subcall function 000F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0

_free.LIBCMT ref: 000FD838
_free.LIBCMT ref: 000FD843
_free.LIBCMT ref: 000FD897
_free.LIBCMT ref: 000FD8A2
_free.LIBCMT ref: 000FD8AD
_free.LIBCMT ref: 000FD8B8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: cd737ba26dfaf364654ed884dac576c2ddce0bbd380adf366fd1631b6ff96c75
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 0B11247158470CAAD521BFB0CC47FEF7BDD6F04700F404816B399AA8A3EA69B5056650

Function 0012DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0012DA74
LoadStringW.USER32(00000000), ref: 0012DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0012DA91
LoadStringW.USER32(00000000), ref: 0012DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0012DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0012DAB9

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: acc24c99aee3ace133152996904fa33267099c1f2d02d06dce9d6a52beb15937
Instruction ID: 78eb0b45c965ffbe37c210bee044b665fd8401d8b5230c93d391a7c72cebb541
Opcode Fuzzy Hash: acc24c99aee3ace133152996904fa33267099c1f2d02d06dce9d6a52beb15937
Instruction Fuzzy Hash: 170162F6500318BFE710ABA4ED89EEB326CE708306F404491B706E6041EA749E848FB4

Function 0013096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00DBE200,00DBE200), ref: 0013097B
EnterCriticalSection.KERNEL32(00DBE1E0,00000000), ref: 0013098D
TerminateThread.KERNEL32(?,000001F6), ref: 0013099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 001309A9
CloseHandle.KERNEL32(?), ref: 001309B8
InterlockedExchange.KERNEL32(00DBE200,000001F6), ref: 001309C8
LeaveCriticalSection.KERNEL32(00DBE1E0), ref: 001309CF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 3983d6e2fac9bc02f441799608a172fcc5c024d38e4ee20712033a7c805944e4
Instruction ID: 43c5c5f7abc80535bf27e359d93da0cd1bce38b4868b5938310de4cf3721ecae
Opcode Fuzzy Hash: 3983d6e2fac9bc02f441799608a172fcc5c024d38e4ee20712033a7c805944e4
Instruction Fuzzy Hash: 2AF0CD31442B12EFD7525F94EE89BDA7A65FF05706F401015F10258CA1CB7594A5CFD0

Function 000C5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 000C5D30
GetWindowRect.USER32(?,?), ref: 000C5D71
ScreenToClient.USER32(?,?), ref: 000C5D99
GetClientRect.USER32(?,?), ref: 000C5ED7
GetWindowRect.USER32(?,?), ref: 000C5EF8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: bf33e4a210cfdc4ee52079a21212455f98a967e19b1b1d5bd6d4ee396daa081c
Instruction ID: e54b078a6e1da10e557f958f70b922ac0471bb1e978b059a782feb0031d4abfa
Opcode Fuzzy Hash: bf33e4a210cfdc4ee52079a21212455f98a967e19b1b1d5bd6d4ee396daa081c
Instruction Fuzzy Hash: 7BB14C78A0074ADBDB14CFA9C880BEEB7F1BF58311F14841EE999D7250D730AA91DB54

Function 000F01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 000F00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000F00D6
__allrem.LIBCMT ref: 000F00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000F010B
__allrem.LIBCMT ref: 000F0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000F0140

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 867f9c68ce14ac78fe5e4b8ed0ad9f3a007cfcac25d1ab3ecb33374e853bd332
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 1C811972600B0AAFE7209F69CC41BBB73E9AF41724F24453EF651D7A82EB75D9009B50

Function 00141D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00143149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,0014101C,00000000,?,?,00000000), ref: 00143195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00141DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00141DE1
WSAGetLastError.WSOCK32 ref: 00141DF2
inet_ntoa.WSOCK32(?), ref: 00141E8C
htons.WSOCK32(?,?,?,?,?), ref: 00141EDB
_strlen.LIBCMT ref: 00141F35

Part of subcall function 001239E8: _strlen.LIBCMT ref: 001239F2

Part of subcall function 000C6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,000DCF58,?,?,?), ref: 000C6DBA
Part of subcall function 000C6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,000DCF58,?,?,?), ref: 000C6DED

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: a29e9e7bb1b6e8c765eada1767130dd634eec3cf2144dc310cadc3de8cf673fb
Instruction ID: d915866c5e3be728bcbbd534ac675965cb461aa5af219c75bb05486ab4885274
Opcode Fuzzy Hash: a29e9e7bb1b6e8c765eada1767130dd634eec3cf2144dc310cadc3de8cf673fb
Instruction Fuzzy Hash: 66A1CE71604340AFC324DF20C895F6A7BA5AF94318F94895CF45A5B2A3CB31ED8ACB91

Function 000F61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,000E82D9,000E82D9,?,?,?,000F644F,00000001,00000001,8BE85006), ref: 000F6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,000F644F,00000001,00000001,8BE85006,?,?,?), ref: 000F62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 000F63D8
__freea.LIBCMT ref: 000F63E5

Part of subcall function 000F3820: RtlAllocateHeap.NTDLL(00000000,?,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6,?,000C1129), ref: 000F3852

__freea.LIBCMT ref: 000F63EE
__freea.LIBCMT ref: 000F6413

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: f28c1c16d1ff3ba0e72b006e36294361971dc75b40992cb30a268b959ef837d3
Instruction ID: 468905e7c5e34dc74cddaeb9976564366b4f5e20deeaf729453268d612ed4288
Opcode Fuzzy Hash: f28c1c16d1ff3ba0e72b006e36294361971dc75b40992cb30a268b959ef837d3
Instruction Fuzzy Hash: 76512172A0021AAFEB258F64CC81EBF77AAEF50750F144228FE05D7941DB36DD44E6A0

Function 0014BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 0014C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0014B6AE,?,?), ref: 0014C9B5
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014C9F1
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA68
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0014BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0014BD25
RegCloseKey.ADVAPI32(00000000), ref: 0014BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0014BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0014BDF3
RegCloseKey.ADVAPI32(?), ref: 0014BDFF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 733329bc68f0cf8480ed8b11168c2bf06026b241f9ce3ea9a0fa77f16c912af1
Instruction ID: 93b73353a5ad5b78578e5b75113ca385663f30635170631e707224cc9d04f98f
Opcode Fuzzy Hash: 733329bc68f0cf8480ed8b11168c2bf06026b241f9ce3ea9a0fa77f16c912af1
Instruction Fuzzy Hash: 6E815870608241AFD714DF64C8D5E6ABBE5FF84308F14899CF4598B2A2DB32ED45CB92

Function 0011F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0011F7B9
SysAllocString.OLEAUT32(00000001), ref: 0011F860
VariantCopy.OLEAUT32(0011FA64,00000000), ref: 0011F889
VariantClear.OLEAUT32(0011FA64), ref: 0011F8AD
VariantCopy.OLEAUT32(0011FA64,00000000), ref: 0011F8B1
VariantClear.OLEAUT32(?), ref: 0011F8BB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 366ee587ed9b28c8adea1472248d95a6a08d25e93b8650fe8922fef356d80eec
Instruction ID: 2992341bb49fbbb7f6dca69eea46391a9ace7a0f05503d457158162ceb60f2be
Opcode Fuzzy Hash: 366ee587ed9b28c8adea1472248d95a6a08d25e93b8650fe8922fef356d80eec
Instruction Fuzzy Hash: 7251D531500314BACF18AF65D895BA9B3A5EF55314F24847FF806DF292DB708C85CBA6

Function 0013910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 000C7620: _wcslen.LIBCMT ref: 000C7625

Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 001394E5
_wcslen.LIBCMT ref: 00139506
_wcslen.LIBCMT ref: 0013952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00139585

Strings

X, xrefs: 00139412

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 74a63b6f041c65a7023f3798d7997e000ba438285d70eafc6f6ae59ec40f1bf9
Instruction ID: 0547a395e86a7e0e2b814b578077bf1b9d020eb49b106e16dfb5cd973466fecb
Opcode Fuzzy Hash: 74a63b6f041c65a7023f3798d7997e000ba438285d70eafc6f6ae59ec40f1bf9
Instruction Fuzzy Hash: E3E16B716083409FD724EF24C885BAEB7E4BF85314F04896DF8899B2A2DB71DD45CB92

Function 000D920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2

BeginPaint.USER32(?,?,?), ref: 000D9241
GetWindowRect.USER32(?,?), ref: 000D92A5
ScreenToClient.USER32(?,?), ref: 000D92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 000D92D3
EndPaint.USER32(?,?,?,?,?), ref: 000D9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 001171EA

Part of subcall function 000D9339: BeginPath.GDI32(00000000), ref: 000D9357

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: c0dde96bb26a5ab6da80b49bb6d34a42260cc9956b43bde0c08b2060d6a9af77
Instruction ID: fe58bf18ef468a28c720816b4975a0ba12778f7b0172ea05f48cfa81f726611f
Opcode Fuzzy Hash: c0dde96bb26a5ab6da80b49bb6d34a42260cc9956b43bde0c08b2060d6a9af77
Instruction Fuzzy Hash: 75419A70108301EFD721DF24CC84FBA7BB8EB59725F14062AF9A59B2E2C7319985DB61

Function 001307EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0013080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00130847
EnterCriticalSection.KERNEL32(?), ref: 00130863
LeaveCriticalSection.KERNEL32(?), ref: 001308DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 001308F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00130921

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: c607de4c63a9e145a68b378525e3d60215044f0f0fdbcbb1798f563d3e6b3ee4
Instruction ID: 9b8bf10acc6a2c636bea4ccf6c89fe996cad8873df4d5f84b07060516f36b075
Opcode Fuzzy Hash: c607de4c63a9e145a68b378525e3d60215044f0f0fdbcbb1798f563d3e6b3ee4
Instruction Fuzzy Hash: 59415871900305EFDF159F54DC85AAA77B8FF08300F1480A5E905AA29BDB70DEA0DBA0

Function 001581DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0011F3AB,00000000,?,?,00000000,?,0011682C,00000004,00000000,00000000), ref: 0015824C
EnableWindow.USER32(?,00000000), ref: 00158272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 001582D1
ShowWindow.USER32(?,00000004), ref: 001582E5
EnableWindow.USER32(?,00000001), ref: 0015830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0015832F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 6f9441cb30a9e3c2db0e3ba51e875167f790f32ca589b125dd6ea5847cdf9bc6
Instruction ID: 978aa05f20b3c989f60731ed994b4721ac9b9a1b68464a62cccaf19999193766
Opcode Fuzzy Hash: 6f9441cb30a9e3c2db0e3ba51e875167f790f32ca589b125dd6ea5847cdf9bc6
Instruction Fuzzy Hash: 2A41B430601745EFDF12DF15C899BE47BF1FB0A716F184169E9289F662CB31A889CB50

Function 00124C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00124C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00124CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00124CEA
_wcslen.LIBCMT ref: 00124D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00124D10
_wcsstr.LIBVCRUNTIME ref: 00124D1A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 1ada09750a19491b1cda152c1b77ed4c77e9acf544a09415225f2546f9fc3a0c
Instruction ID: 8dbd6ce5c9765f034e19d983246c83c806fb076ffc363d4126ffb37a6d0fba78
Opcode Fuzzy Hash: 1ada09750a19491b1cda152c1b77ed4c77e9acf544a09415225f2546f9fc3a0c
Instruction Fuzzy Hash: 4C210472204325BFEB155B79AC09EBB7B9CDF55750F10802AF809DA292EB61CD5086A0

Function 0013581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 000C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000C3A97,?,?,000C2E7F,?,?,?,00000000), ref: 000C3AC2

_wcslen.LIBCMT ref: 0013587B
CoInitialize.OLE32(00000000), ref: 00135995
CoCreateInstance.OLE32(0015FCF8,00000000,00000001,0015FB68,?), ref: 001359AE
CoUninitialize.OLE32 ref: 001359CC

Strings

.lnk, xrefs: 00135876, 001358C1, 00135985

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 96ae7aaf4f45f504de1a72acfd6c2d9399b5508efcb8d881ad92f59ac07c07a5
Instruction ID: d046deeca5c90afedf59c3c2adf6e577c98fc09c0d523a38f3b7b8c8d7ec895b
Opcode Fuzzy Hash: 96ae7aaf4f45f504de1a72acfd6c2d9399b5508efcb8d881ad92f59ac07c07a5
Instruction Fuzzy Hash: 42D13071608601DFC714DF24C484A6EBBE6EF89B14F14885DF88A9B362DB31ED45CB92

Function 0012175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00120FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00120FCA
Part of subcall function 00120FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00120FD6
Part of subcall function 00120FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00120FE5
Part of subcall function 00120FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00120FEC
Part of subcall function 00120FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00121002

GetLengthSid.ADVAPI32(?,00000000,00121335), ref: 001217AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 001217BA
HeapAlloc.KERNEL32(00000000), ref: 001217C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 001217DA
GetProcessHeap.KERNEL32(00000000,00000000,00121335), ref: 001217EE
HeapFree.KERNEL32(00000000), ref: 001217F5

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: c04f5c9b13312f08b4d3a402fbbac83fe7326c350e97db0d274652ca4fabc9cc
Instruction ID: 0c5800aaaefb06f968b2cb46d916b8a7412ab1525de1c3831444a0ea47b257d5
Opcode Fuzzy Hash: c04f5c9b13312f08b4d3a402fbbac83fe7326c350e97db0d274652ca4fabc9cc
Instruction Fuzzy Hash: 8611BE32500715FFDB10DFA4EC89BAF7BA9EB95356F104018F4419B211D735A990CBA0

Function 001214CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 001214FF
OpenProcessToken.ADVAPI32(00000000), ref: 00121506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00121515
CloseHandle.KERNEL32(00000004), ref: 00121520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0012154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00121563

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 5f6227ca41c7a357fd9a5bced16900bdc6ac5e9e21e80d740f867c981fedea63
Instruction ID: cb742495d1963dfb0d85c21db20141a912d1e92036ecb8521de50a4011a17f11
Opcode Fuzzy Hash: 5f6227ca41c7a357fd9a5bced16900bdc6ac5e9e21e80d740f867c981fedea63
Instruction Fuzzy Hash: EA11447250024DFFDB11CFA8ED49BDA7BA9EB48705F044064FA05A60A0C3718EA0DBA0

Function 000E3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000E3379,000E2FE5), ref: 000E3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000E339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000E33B7
SetLastError.KERNEL32(00000000,?,000E3379,000E2FE5), ref: 000E3409

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bc5969bffdea15a252fd918b92677569509e45cecad89dcd845bd58eae17c418
Instruction ID: 0bc8454ad8873f3bae8e458ed4395308fd4058566c977cf5ac6c9872a72d0b1f
Opcode Fuzzy Hash: bc5969bffdea15a252fd918b92677569509e45cecad89dcd845bd58eae17c418
Instruction Fuzzy Hash: 8E016832208351BFA76627777C8D9AA2FD4EB003B9330422AF110B31F2EF210F4156A0

Function 000F2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000F5686,00103CD6,?,00000000,?,000F5B6A,?,?,?,?,?,000EE6D1,?,00188A48), ref: 000F2D78
_free.LIBCMT ref: 000F2DAB
_free.LIBCMT ref: 000F2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,000EE6D1,?,00188A48,00000010,000C4F4A,?,?,00000000,00103CD6), ref: 000F2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,000EE6D1,?,00188A48,00000010,000C4F4A,?,?,00000000,00103CD6), ref: 000F2DEC
_abort.LIBCMT ref: 000F2DF2

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 77286cd9d1b577f944186a51604a91296439f455624b0e21736702f61285148c
Instruction ID: 150b754d0c2b868b899910d3c637a7b2aa0368bdd56779b048cdda8f8ad00414
Opcode Fuzzy Hash: 77286cd9d1b577f944186a51604a91296439f455624b0e21736702f61285148c
Instruction Fuzzy Hash: ECF02831545B0C6BC2A22734BC0AEBF2599BFC17B1F210019FB2496DE3EF34894171A0

Function 00158A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 000D9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 000D9693
Part of subcall function 000D9639: SelectObject.GDI32(?,00000000), ref: 000D96A2
Part of subcall function 000D9639: BeginPath.GDI32(?), ref: 000D96B9
Part of subcall function 000D9639: SelectObject.GDI32(?,00000000), ref: 000D96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00158A4E
LineTo.GDI32(?,00000003,00000000), ref: 00158A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00158A70
LineTo.GDI32(?,00000000,00000003), ref: 00158A80
EndPath.GDI32(?), ref: 00158A90
StrokePath.GDI32(?), ref: 00158AA0

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 0a436127f96b2605cd492b6ea63efb7475c20d536123c269ef515d3d8348eb01
Instruction ID: 00fc4ea27f3dd2740896ec9ff000e6c8f6033f9ecdf4bc16844f7ba07392d7fb
Opcode Fuzzy Hash: 0a436127f96b2605cd492b6ea63efb7475c20d536123c269ef515d3d8348eb01
Instruction Fuzzy Hash: 4B11DB7600024DFFDF129F94DC88EAA7F6DEB08395F048012BA199A5A1C7729D95DFA0

Function 001251FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00125218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00125229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00125230
ReleaseDC.USER32(00000000,00000000), ref: 00125238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0012524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00125261

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 0e3d60ab88a7e83b1d90d89dae25d6986ba8201ffe02f3d95925257107060d25
Instruction ID: 50f7f041a162a1b02f2db3579a4a5a281bcd9e85fdfde33cb3c28032558eb89b
Opcode Fuzzy Hash: 0e3d60ab88a7e83b1d90d89dae25d6986ba8201ffe02f3d95925257107060d25
Instruction Fuzzy Hash: 7C018F75A00718FFEB109FA59C49A4EBFB8EB48752F044065FA04AB281D6709900CBA0

Function 000C1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 000C1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 000C1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 000C1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 000C1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 000C1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 000C1C22

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 8899023dfc6eaa812f40f6bc09d7b9cbb1a888a27505193debebbfaaf8cbc333
Instruction ID: 24a0b788c56c8f607e7fe5927ad736ab38ce076df7499988714f3e419d6a958d
Opcode Fuzzy Hash: 8899023dfc6eaa812f40f6bc09d7b9cbb1a888a27505193debebbfaaf8cbc333
Instruction Fuzzy Hash: C1016CB0902759BDE3008F5A8C85B52FFA8FF19354F00411B915C4BA41C7F5A864CBE5

Function 0012EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0012EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0012EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0012EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0012EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0012EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0012EB75

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 939b7ab0e6cbf075eba6949563a99f8706e189720721c2195e6bf9c0ca4d04fb
Instruction ID: a4de9333d34ae4e3cf74faf7a81af609adaad912c65964c5bf23abb522290253
Opcode Fuzzy Hash: 939b7ab0e6cbf075eba6949563a99f8706e189720721c2195e6bf9c0ca4d04fb
Instruction Fuzzy Hash: 0BF01772240758FFE6215B629C0EEEB3A7CEBCAB12F000158F601D9591A7A05A818AF5

Function 00117439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00117452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00117469
GetWindowDC.USER32(?), ref: 00117475
GetPixel.GDI32(00000000,?,?), ref: 00117484
ReleaseDC.USER32(?,00000000), ref: 00117496
GetSysColor.USER32(00000005), ref: 001174B0

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 5d39f3a99d55e5a3c6ec3837a32640e4e9e2f99a41f5c0d112b079de120a3476
Instruction ID: 2e66e3ffda473d64fcd95e5628be9af3fe26f58d6b972957a901cd93f3a7c0c2
Opcode Fuzzy Hash: 5d39f3a99d55e5a3c6ec3837a32640e4e9e2f99a41f5c0d112b079de120a3476
Instruction Fuzzy Hash: 4C014B31500315FFEB515FA4DC48BEABBB6FB04322F510164F916A7AA1CB311E91EB90

Function 00121874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0012187F
UnloadUserProfile.USERENV(?,?), ref: 0012188B
CloseHandle.KERNEL32(?), ref: 00121894
CloseHandle.KERNEL32(?), ref: 0012189C
GetProcessHeap.KERNEL32(00000000,?), ref: 001218A5
HeapFree.KERNEL32(00000000), ref: 001218AC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 5d9e38e811384c4ddc0bc9332aaac19e9c45f74fcf74aa6c2fe3ab5aa437985d
Instruction ID: bc5fb2245f94799f2bddfb0cb5e538be1959224f7a1db5e28e55a6d2d2e6ffe0
Opcode Fuzzy Hash: 5d9e38e811384c4ddc0bc9332aaac19e9c45f74fcf74aa6c2fe3ab5aa437985d
Instruction Fuzzy Hash: 90E05276104705FFDA015FA5ED0C94ABB69FB49B22B508625F22689871CB32A4A1DB90

Function 0012C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C7620: _wcslen.LIBCMT ref: 000C7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0012C6EE
_wcslen.LIBCMT ref: 0012C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0012C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0012C7CA

Strings

0, xrefs: 0012C6AF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 18b8f88dc778e3e7d0fb250d323adb45916d4c84055649178194d71d8f3718ee
Instruction ID: 10c18c4ea0c7169c71e02e6a9d18c5b5c5b16817a4b3233b83832011ba50ed38
Opcode Fuzzy Hash: 18b8f88dc778e3e7d0fb250d323adb45916d4c84055649178194d71d8f3718ee
Instruction Fuzzy Hash: AB51F1716043219BD7149F28E884BAF77E8AF49314F040A2DFA95E3291DB70DD64CBD2

Function 0014AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0014AEA3

Part of subcall function 000C7620: _wcslen.LIBCMT ref: 000C7625

GetProcessId.KERNEL32(00000000), ref: 0014AF38
CloseHandle.KERNEL32(00000000), ref: 0014AF67

Strings

<, xrefs: 0014AE6B
@, xrefs: 0014AE72

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: c9cd93d9ce7fa23ce1d7f248e5aff332e1c3c7fd260b627419cbce9b1dbcf855
Instruction ID: 4df0c0bd07eb5199abf6723ce891d0f79aed648646556e079d7c9c484ac3a949
Opcode Fuzzy Hash: c9cd93d9ce7fa23ce1d7f248e5aff332e1c3c7fd260b627419cbce9b1dbcf855
Instruction Fuzzy Hash: 55713671A00619DFCB14DFA4C494A9EBBF0BF08314F458499E85AAB3A2CB74ED45CB91

Function 0012719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00127206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0012723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0012724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 001272CF

Strings

DllGetClassObject, xrefs: 00127242

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 4c7d089a5a43afb730991e3d03fca9889e427647f05770959e7ed69fa644129e
Instruction ID: ea06b45cceb865e3fcc751193150c9aa5a36d6fcaaf98972d9639ec9bf0ad0c6
Opcode Fuzzy Hash: 4c7d089a5a43afb730991e3d03fca9889e427647f05770959e7ed69fa644129e
Instruction Fuzzy Hash: 2F418D71A04314EFDB15DF94D884A9B7BA9EF44310F1580ADFD059F28AD7B0DA54CBA0

Function 00153D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00153E35
IsMenu.USER32(?), ref: 00153E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00153E92
DrawMenuBar.USER32 ref: 00153EA5

Strings

0, xrefs: 00153D89

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 02c9707213547990d139bce0d474604eb65136777bb78c4fa628e9b78e1877b9
Instruction ID: 355f451538e805bcef36b6b3d8ed9b624f86abd859623a73a440746569fc543d
Opcode Fuzzy Hash: 02c9707213547990d139bce0d474604eb65136777bb78c4fa628e9b78e1877b9
Instruction Fuzzy Hash: 4E414B75A00209EFDB10DF90D885ADAB7F5FF45395F044119ED259B250D770AE49CF60

Function 00121DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00121E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00121E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00121EA9

Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A

Strings

ListBox, xrefs: 00121E25
ComboBox, xrefs: 00121DF0

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 4140e6cc1fb5b315d8b560deefa9412a7d8dea8773df3ba9c3c44b7cd7adb170
Instruction ID: 0dfe07e80e0a6f97bc40a34681ee27f0abeb09d656032219bad99f8529e5816e
Opcode Fuzzy Hash: 4140e6cc1fb5b315d8b560deefa9412a7d8dea8773df3ba9c3c44b7cd7adb170
Instruction Fuzzy Hash: 97213771A00204BEDB15EF64EC46DFFB7B9DF51350B104129F825A72E1DB344E198660

Function 0014C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0014C9F1
_wcslen.LIBCMT ref: 0014CA68
_wcslen.LIBCMT ref: 0014CA9E
_wcslen.LIBCMT ref: 0014CAF9
_wcslen.LIBCMT ref: 0014CB2F
_wcslen.LIBCMT ref: 0014CB7F

Strings

HKLM, xrefs: 0014CA98, 0014CA9D
HKEY_LOCAL_MACHINE, xrefs: 0014CA62, 0014CA67

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: dc50727afe0082a9a3016f5cb087d6c98556acad59114113a36dfd1bf806065f
Instruction ID: 3ea5419ebb44ce23e9c79e378191bd55300aed54686436b86c29ebf566e653eb
Opcode Fuzzy Hash: dc50727afe0082a9a3016f5cb087d6c98556acad59114113a36dfd1bf806065f
Instruction Fuzzy Hash: 1D313A73A0216A4BCB60EF2CC9405BF33915BA1750B754029E841BB3A5FB71CE84D7E0

Function 00152F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00152F8D
LoadLibraryW.KERNEL32(?), ref: 00152F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00152FA9
DestroyWindow.USER32(?), ref: 00152FB1

Strings

SysAnimate32, xrefs: 00152F68

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 122bd3a2a809ea87c891ee54c3af20e8a154fd758d893b3536095fde197c2b4d
Instruction ID: 389de86050da0f9a3bca4032f24ae50f2ec102d12e73f85930583d50dc92c913
Opcode Fuzzy Hash: 122bd3a2a809ea87c891ee54c3af20e8a154fd758d893b3536095fde197c2b4d
Instruction Fuzzy Hash: BD218C72204205EFEB104F64EC80FBB77B9EB5A366F10461AFD60EA190D771DC959BA0

Function 000E4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,000E4D1E,000F28E9,?,000E4CBE,000F28E9,001888B8,0000000C,000E4E15,000F28E9,00000002), ref: 000E4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000E4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,000E4D1E,000F28E9,?,000E4CBE,000F28E9,001888B8,0000000C,000E4E15,000F28E9,00000002,00000000), ref: 000E4DC3

Strings

mscoree.dll, xrefs: 000E4D86
CorExitProcess, xrefs: 000E4D98

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 815151d89a7262a063c734d64d7b94252e95c97a0a8e65b41e7edd5e962f6314
Instruction ID: ee8fab756560f035d0085d820fefc488cd6f3517e21776bdb18887f96e6e5a0c
Opcode Fuzzy Hash: 815151d89a7262a063c734d64d7b94252e95c97a0a8e65b41e7edd5e962f6314
Instruction Fuzzy Hash: F5F03C35A40308EFDB519F95DC49BEEBBE5EB44752F0400A8B805A6660CB705A90CBD1

Function 000C4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,000C4EDD,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 000C4EAE
FreeLibrary.KERNEL32(00000000,?,?,000C4EDD,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4EC0

Strings

kernel32.dll, xrefs: 000C4E94
Wow64DisableWow64FsRedirection, xrefs: 000C4EA8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: a0f85571bacb0a5e79c359c664a37c3faca91c8b3935156194439a4a1bf8f02f
Instruction ID: e3f24cfd7a567f062b6165b5c94018558f3d86b975c2117652ee9631353ce635
Opcode Fuzzy Hash: a0f85571bacb0a5e79c359c664a37c3faca91c8b3935156194439a4a1bf8f02f
Instruction Fuzzy Hash: F8E08635A01B22DFD2611F256C68F5F6694BF81F637060119FC00E6500DB60CD4185E0

Function 000C4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00103CDE,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 000C4E74
FreeLibrary.KERNEL32(00000000,?,?,00103CDE,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E87

Strings

kernel32.dll, xrefs: 000C4E5B
Wow64RevertWow64FsRedirection, xrefs: 000C4E6E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: e1054590682e83da9de697bd410757d6d10383af70c5c25bfc9033345f443d6c
Instruction ID: 10aa7ec4febd8ac90c766e34783451489792b0b410ce4231648e2aa4bf08586d
Opcode Fuzzy Hash: e1054590682e83da9de697bd410757d6d10383af70c5c25bfc9033345f443d6c
Instruction Fuzzy Hash: 2FD01235502B21DF96621F297C28ECF6A58BF85F523060519BD05AA555CF60CE41C5D0

Function 00132947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00132C05
DeleteFileW.KERNEL32(?), ref: 00132C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00132C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00132CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00132CC0

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 77147179a1418470fa61f7b67e259396abb75bddac4a833fe3e68980d2db54ed
Instruction ID: 5db6f64145b6b56708e248a67074fe9f27521201156035cde84fd611e3f5d900
Opcode Fuzzy Hash: 77147179a1418470fa61f7b67e259396abb75bddac4a833fe3e68980d2db54ed
Instruction Fuzzy Hash: 38B12E71900219AFDF25EBA4CC85EDEB77DEF49350F1040A6F509E6156EB30AA448F61

Function 0014A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0014A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0014A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0014A468
CloseHandle.KERNEL32(?), ref: 0014A63D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 6d31f0a24dc67730b306b86238a2f03766c6d4902254dd9bad00e32ce68b122a
Instruction ID: f99fbc2fe9efdee113bdb5f00376c049d9cc25e82fa84a770bcb8736d2113944
Opcode Fuzzy Hash: 6d31f0a24dc67730b306b86238a2f03766c6d4902254dd9bad00e32ce68b122a
Instruction Fuzzy Hash: A6A1B0716043019FE720DF24C886F6AB7E5AF84714F55881DF59A9B3D2D7B0EC418B92

Function 0012E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0012DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0012CF22,?), ref: 0012DDFD

Part of subcall function 0012DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0012CF22,?), ref: 0012DE16

Part of subcall function 0012E199: GetFileAttributesW.KERNEL32(?,0012CF95), ref: 0012E19A

lstrcmpiW.KERNEL32(?,?), ref: 0012E473
MoveFileW.KERNEL32(?,?), ref: 0012E4AC
_wcslen.LIBCMT ref: 0012E5EB
_wcslen.LIBCMT ref: 0012E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0012E650

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 6cc56392560fffd2485e127e9e9f4ac5aee3d4d84149cf0f429c6ff5814c800a
Instruction ID: 670af0b42a38d6db6e55823b4b6b851082972b6aaa35de19fcf1f3204b2912ba
Opcode Fuzzy Hash: 6cc56392560fffd2485e127e9e9f4ac5aee3d4d84149cf0f429c6ff5814c800a
Instruction Fuzzy Hash: F95153B24083959FC724EB90EC819DF73DCAF95340F40492EF689D3192EF74A6988766

Function 0014B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 0014C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0014B6AE,?,?), ref: 0014C9B5
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014C9F1
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA68
Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0014BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0014BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0014BB63
RegCloseKey.ADVAPI32(?,?), ref: 0014BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0014BBB3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 11aa2305b651cbc5975db79f878b5bfd9dd90e78438a746a37d6b47fdb8b0a2a
Instruction ID: d28b93e3856744dc8ddb514ac532dc78a94645030a000818810e23ca1668c88b
Opcode Fuzzy Hash: 11aa2305b651cbc5975db79f878b5bfd9dd90e78438a746a37d6b47fdb8b0a2a
Instruction Fuzzy Hash: 4B616C31208241AFD714DF24C8D5E6ABBE5FF84318F54899CF4998B2A2DB31ED45CB92

Function 00128BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00128BCD
VariantClear.OLEAUT32 ref: 00128C3E
VariantClear.OLEAUT32 ref: 00128C9D
VariantClear.OLEAUT32(?), ref: 00128D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00128D3B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 2b7a0d1c284677a059128f1ec9754c952fc3cc41060e95628d60e34986fc2dfa
Instruction ID: a05c221047df2524d7e3b8a689dbfde00f8671fcdfdbebaa09b2d03f9f842889
Opcode Fuzzy Hash: 2b7a0d1c284677a059128f1ec9754c952fc3cc41060e95628d60e34986fc2dfa
Instruction Fuzzy Hash: 855159B5A01219EFDB14CF68D894EAAB7F8FF89310B158559E905DB350E730E921CFA0

Function 00138AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00138BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00138BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00138C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00138C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00138C5F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 92fb7039575740258cc2166c559b72a8b8731c085d4f730d6aca65a014aab5f0
Instruction ID: a1c345138d0aa051060291fe18ed7df0b694408a280f62cd068ea280c806e836
Opcode Fuzzy Hash: 92fb7039575740258cc2166c559b72a8b8731c085d4f730d6aca65a014aab5f0
Instruction Fuzzy Hash: DC511835A006159FCB05DF64C881EADBBF5FF48314F088459E849AB362DB35ED51DBA0

Function 00148EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00148F40
GetProcAddress.KERNEL32(00000000,?), ref: 00148FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00148FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00149032
FreeLibrary.KERNEL32(00000000), ref: 00149052

Part of subcall function 000DF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00131043,?,753CE610), ref: 000DF6E6
Part of subcall function 000DF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0011FA64,00000000,00000000,?,?,00131043,?,753CE610,?,0011FA64), ref: 000DF70D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 6c5f4a52a3fa5066373da70bdc960e6b5b4f4b9e8ee3849f0594fd399df550ed
Instruction ID: c40585d05bbe82e99b2ebfff2a120ce69578a4861bfc7eee649297b62c074f15
Opcode Fuzzy Hash: 6c5f4a52a3fa5066373da70bdc960e6b5b4f4b9e8ee3849f0594fd399df550ed
Instruction Fuzzy Hash: 3B513635600605DFCB15DF68C494DADBBF1FF49324B4580A9E80A9B762DB31ED89CB90

Function 00156B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00156C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00156C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00156C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0013AB79,00000000,00000000), ref: 00156C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00156CC7

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 9c2bae1bad8bc8f710dc28544e4ca507d0099e89715370da3a8783a06a176be9
Instruction ID: b946714aeeb8eb5d3fc5feb23ee2e71c4033abe0697561862a49708655c759aa
Opcode Fuzzy Hash: 9c2bae1bad8bc8f710dc28544e4ca507d0099e89715370da3a8783a06a176be9
Instruction Fuzzy Hash: AC41D635604204EFD724CF28CC55FA97BA5EB09361F950228FCA9AF2E1C371AD85DAC0

Function 000F2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000F20C3
_free.LIBCMT ref: 000F20E3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8a38d205a4ba14fcc708b70e68c6899bef41228852cec66a3358327d66d37c5a
Instruction ID: 58d14d93d475f18a91d2218ef85c13c0c2854fdf3489ffec56b43c1737b91eaa
Opcode Fuzzy Hash: 8a38d205a4ba14fcc708b70e68c6899bef41228852cec66a3358327d66d37c5a
Instruction Fuzzy Hash: 1741D332A003089FCB24DF78C881AADB7F5EF89314F154569E615EB792DB31AD01DB90

Function 000D912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 000D9141
ScreenToClient.USER32(00000000,?), ref: 000D915E
GetAsyncKeyState.USER32(00000001), ref: 000D9183
GetAsyncKeyState.USER32(00000002), ref: 000D919D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: d60dfc8047f65869632cac979d2193073a116ab4b933ac3433ff6811a9153a6a
Instruction ID: 53df3745ed2c6a9a411ca68c8ca088ac6858aebfe65eaf59ca1e272333caf9b9
Opcode Fuzzy Hash: d60dfc8047f65869632cac979d2193073a116ab4b933ac3433ff6811a9153a6a
Instruction Fuzzy Hash: 3D416075A0860AFBDF199F64C844BEEB774FF05320F208226E825A73D0C7346994CBA1

Function 00133874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 001338CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00133922
TranslateMessage.USER32(?), ref: 0013394B
DispatchMessageW.USER32(?), ref: 00133955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00133966

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 5e6049affda6fdfce261c52e28f3429419d34348fdf011dd35d90bb8a4253c67
Instruction ID: 04172ca386666c26980e0d17df44222cfbceabf9c95cc5de7649ca78abe69b96
Opcode Fuzzy Hash: 5e6049affda6fdfce261c52e28f3429419d34348fdf011dd35d90bb8a4253c67
Instruction Fuzzy Hash: 7931D570904342EEEF35CB34D849BB637A8EB05308F04056EE472C65A0E3B49AC5CB55

Function 0013CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0013CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0013CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0013C21E,00000000), ref: 0013CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0013C21E,00000000), ref: 0013CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0013C21E,00000000), ref: 0013CFF2

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 52369a9d945b4d3e0bfd1271066a7a2022ebf47bd83944a813561284d96c931d
Instruction ID: 09c3423ced454979a1c7cebd99538ac42e6bfac94cf85d9ac496ba870c6b7951
Opcode Fuzzy Hash: 52369a9d945b4d3e0bfd1271066a7a2022ebf47bd83944a813561284d96c931d
Instruction Fuzzy Hash: 0B316B71500306EFDB24DFA5C8849ABBBFEEB14311F10842EF506E6601DB30AE41DBA0

Function 00121901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00121915
PostMessageW.USER32(00000001,00000201,00000001), ref: 001219C1
Sleep.KERNEL32(00000000,?,?,?), ref: 001219C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 001219DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 001219E2

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 55efd2e95ace8a38d1163678509c86f997f0a1a21089592b9756659a9b7dafb9
Instruction ID: c4eb4a62ed7d3f2ca8df01691fa29870492f848b3abe73891cb462da83a180d6
Opcode Fuzzy Hash: 55efd2e95ace8a38d1163678509c86f997f0a1a21089592b9756659a9b7dafb9
Instruction Fuzzy Hash: D8319171900229EFCF14CFA8DD99ADE7BB5EB54319F104225F921AB2D1C7709A94CB90

Function 00155706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00155745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0015579D
_wcslen.LIBCMT ref: 001557AF
_wcslen.LIBCMT ref: 001557BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00155816

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 287d5e540b0b55b35a3de3da4ef5baaa42a432434abb5470be66161fd6903639
Instruction ID: 69c276bc6b3ffa90c51adbb7d1870a5ccd85534d926c82de883d01fbe27c08d6
Opcode Fuzzy Hash: 287d5e540b0b55b35a3de3da4ef5baaa42a432434abb5470be66161fd6903639
Instruction Fuzzy Hash: FB218571904618DADB209FA1CC85AED7BB9FF04726F108256ED39EE181E7708AC9CF50

Function 00140930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00140951
GetForegroundWindow.USER32 ref: 00140968
GetDC.USER32(00000000), ref: 001409A4
GetPixel.GDI32(00000000,?,00000003), ref: 001409B0
ReleaseDC.USER32(00000000,00000003), ref: 001409E8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 3239293efdda94dc5345fe0dd1d30e7dbc6b0ce2d740e28e6eee181006251116
Instruction ID: 3ae7095384eaa390a5e445eaf1e722d5e75475223cbd48a82212d09b6bbb2410
Opcode Fuzzy Hash: 3239293efdda94dc5345fe0dd1d30e7dbc6b0ce2d740e28e6eee181006251116
Instruction Fuzzy Hash: 1F216D35600214EFD704EF65C885AAEBBE9EF58701F04846CF84A9B762CB30AD44CB90

Function 000FCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000FCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000FCDE9

Part of subcall function 000F3820: RtlAllocateHeap.NTDLL(00000000,?,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6,?,000C1129), ref: 000F3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 000FCE0F
_free.LIBCMT ref: 000FCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000FCE31

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 129ce3d3142454bae41996a5b0f83150edbe35a1f94bdf442cc4c534a3d591ae
Instruction ID: 88b53ea378201cdbf88c493156b1c0ab93c8abd9dec09650e4ce2ad4cb158033
Opcode Fuzzy Hash: 129ce3d3142454bae41996a5b0f83150edbe35a1f94bdf442cc4c534a3d591ae
Instruction Fuzzy Hash: 22018872A0171DBF33611A7A6D89DBF79ADEFC6BA13150129FA05C7901DA618D01A1F0

Function 000D9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 000D9693
SelectObject.GDI32(?,00000000), ref: 000D96A2
BeginPath.GDI32(?), ref: 000D96B9
SelectObject.GDI32(?,00000000), ref: 000D96E2

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 2af06f765c6ea15dd036ba1eaef09794f3ec9068fc894614f94e30ddfa0e1066
Instruction ID: 71d228909d3141b82fdb6e57ed2ced9a99ff6276c34a96134a3b468ac6123681
Opcode Fuzzy Hash: 2af06f765c6ea15dd036ba1eaef09794f3ec9068fc894614f94e30ddfa0e1066
Instruction Fuzzy Hash: 46214970802306EFDB119F65EC58BAD7BB9BB5036AF104217F821A66E0D37098D1CBA4

Function 00125711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00125726
_memcmp.LIBVCRUNTIME ref: 00125744
_memcmp.LIBVCRUNTIME ref: 00125757
_memcmp.LIBVCRUNTIME ref: 0012576F
_memcmp.LIBVCRUNTIME ref: 00125787

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: bc4aa5fc11381d476c3281bc8537a37f5b29bd164323ab1d10a3f333eea4e0d3
Instruction ID: a93867109d4f359e6f402fc2f314eecba62263871b11e45c30515c2d86bfa2ce
Opcode Fuzzy Hash: bc4aa5fc11381d476c3281bc8537a37f5b29bd164323ab1d10a3f333eea4e0d3
Instruction Fuzzy Hash: 4201B971681655FFD3089621ADC2FFB735E9B613A5F804034FD14AE242F770EE2582A0

Function 000F2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000EF2DE,000F3863,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6), ref: 000F2DFD
_free.LIBCMT ref: 000F2E32
_free.LIBCMT ref: 000F2E59
SetLastError.KERNEL32(00000000,000C1129), ref: 000F2E66
SetLastError.KERNEL32(00000000,000C1129), ref: 000F2E6F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 76009ad12e89e4252af71b969b958de477a7a52d20eab6f4a033c9fd09c87eb6
Instruction ID: 6e327fe2f3dcbefe30cbb0c482653443496252a69aaf12251ab7ad601b16c44a
Opcode Fuzzy Hash: 76009ad12e89e4252af71b969b958de477a7a52d20eab6f4a033c9fd09c87eb6
Instruction Fuzzy Hash: 6701F932245B0CABC65267746C45D7F2999BBD17717310025FB2193E93EB708D417160

Function 0012000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?,?,0012035E), ref: 0012002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?), ref: 00120046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?), ref: 00120054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?), ref: 00120064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?), ref: 00120070

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 638b3fe3b8cd6a7fdc8ced83bce8677b32c5fa4bdb983c2c7406482715991aa1
Instruction ID: a1ecdaa1c54751f66b64a71ac297b3c2fa697e974267ba801a29feb8036a8b77
Opcode Fuzzy Hash: 638b3fe3b8cd6a7fdc8ced83bce8677b32c5fa4bdb983c2c7406482715991aa1
Instruction Fuzzy Hash: 5201A772600314FFEB114F64EC44BAA7AEDEF48792F144214F905D6221D771DD5087A4

Function 001210F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00121114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 0012112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0012114D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 1e87e32831bbcc18d5c7d10a1cc3a9ef4ec96ec3fdd70a9ad90af60ffcb91f25
Instruction ID: 6dc3499f66fdeb4a483e2d32bb9ed5e1c05717da8b5a265f3a481bbd5214dee2
Opcode Fuzzy Hash: 1e87e32831bbcc18d5c7d10a1cc3a9ef4ec96ec3fdd70a9ad90af60ffcb91f25
Instruction Fuzzy Hash: 21016D79100315FFDB114F64EC49A6A3F6EEF89361B140414FA41D7350DB31DC50CAA0

Function 00120FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00120FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00120FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00120FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00120FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00121002

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 7a5c5489eca32673e393974af274d1c48aed29d375b5ecd38dc37a7b758cabb2
Instruction ID: ae8e797b54ed9d018ad681d0893b3e53d6a99649b88dd89e95091f0c9049a9ad
Opcode Fuzzy Hash: 7a5c5489eca32673e393974af274d1c48aed29d375b5ecd38dc37a7b758cabb2
Instruction Fuzzy Hash: E7F04F39100315FFDB214FA5AC89F5A3BADEF89762F104414F945CA291CA70DC908AA0

Function 00121014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0012102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00121036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00121045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0012104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00121062

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 8da0688ff3aa13191febc7d76d0e7a451bd031ed38778d45327fc9a525967a93
Instruction ID: c1653278e230066f064cd2500560ca5a34502c43c411f12f79a10f8166c6cbda
Opcode Fuzzy Hash: 8da0688ff3aa13191febc7d76d0e7a451bd031ed38778d45327fc9a525967a93
Instruction Fuzzy Hash: 1DF04F39100355FFDB215FA5EC49F5A3BADEF89762F200414F945CA290CA70D8908AA0

Function 0013030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 00130324
CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 00130331
CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 0013033E
CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 0013034B
CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 00130358
CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 00130365

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b4de72970c704654712b5ffaae75d8b8ca4363b9257d67d64cff18660d0b4a00
Instruction ID: 36a4b1e9267a30400de3479db76df40592e8db6ac58a41bc8f677a82a173a13d
Opcode Fuzzy Hash: b4de72970c704654712b5ffaae75d8b8ca4363b9257d67d64cff18660d0b4a00
Instruction Fuzzy Hash: 31019872800B15DFCB32AF66D8A0812FBF9BF642153158A3ED19652931C3B1A998CE80

Function 000FD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000FD752

Part of subcall function 000F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0

_free.LIBCMT ref: 000FD764
_free.LIBCMT ref: 000FD776
_free.LIBCMT ref: 000FD788
_free.LIBCMT ref: 000FD79A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5f03b00cfb4c868c3fd05208f92faf1b8d152eefeb90203ecf35f2141a2de9a3
Instruction ID: 29d0ad801934bce89f955e85ee25156e8d546cc6de177cf0cbbc502a1666be2c
Opcode Fuzzy Hash: 5f03b00cfb4c868c3fd05208f92faf1b8d152eefeb90203ecf35f2141a2de9a3
Instruction Fuzzy Hash: 7FF0FF3258830EAB8661FB64F9C5C6A77DEBB447107A40806F258EBD12D774FC80A7B4

Function 00125C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00125C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00125C6F
MessageBeep.USER32(00000000), ref: 00125C87
KillTimer.USER32(?,0000040A), ref: 00125CA3
EndDialog.USER32(?,00000001), ref: 00125CBD

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: af7bffcce8f5a4dedd386e093c86a0018839ff9a539eeb7e050be94ff956a3f0
Instruction ID: 0b890fe14db93620f30d0b2c49164e126f61e0ddbf03dc2cfa188ebf058889ab
Opcode Fuzzy Hash: af7bffcce8f5a4dedd386e093c86a0018839ff9a539eeb7e050be94ff956a3f0
Instruction Fuzzy Hash: 4D018630500B14EFEB255F10ED8EFA677BDBB04B06F000559A583A55E1EBF0AAE48B90

Function 000F22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000F22BE

Part of subcall function 000F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0

_free.LIBCMT ref: 000F22D0
_free.LIBCMT ref: 000F22E3
_free.LIBCMT ref: 000F22F4
_free.LIBCMT ref: 000F2305

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dc920c5aa96564e4ec0faf0866ab35c775ef5bcb82463a1625611c681172c07c
Instruction ID: 5f342b14bb8839532de3aefccd9305d2b0104601d672d8c9e0fbd46469ae0059
Opcode Fuzzy Hash: dc920c5aa96564e4ec0faf0866ab35c775ef5bcb82463a1625611c681172c07c
Instruction Fuzzy Hash: AFF03A71884126AB8613BF54BC018AC3BA4BB19B60710050BF514D7FB2C7702AD1BFE4

Function 000D95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 000D95D4
StrokeAndFillPath.GDI32(?,?,001171F7,00000000,?,?,?), ref: 000D95F0
SelectObject.GDI32(?,00000000), ref: 000D9603
DeleteObject.GDI32 ref: 000D9616
StrokePath.GDI32(?), ref: 000D9631

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 7a82e0304ac4b490f9c3c951ec0800a4157eb697475086fa59e983aec0f3d429
Instruction ID: dbeab94d337b0dc8d52bf98d906ebf92e563f548e991b312f249c0a3c6cd05f8
Opcode Fuzzy Hash: 7a82e0304ac4b490f9c3c951ec0800a4157eb697475086fa59e983aec0f3d429
Instruction Fuzzy Hash: 6EF0373400670AFFDB625F69ED5CB683BA1EB003AAF048226F425599F0C73189D1DF64

Function 000F0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 000F10F9
__freea.LIBCMT ref: 000F1117

Part of subcall function 000F1537: _free.LIBCMT ref: 000F154F

Strings

a/p, xrefs: 000F11DE
am/pm, xrefs: 000F117A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 043d16d4f16c46e711c3da1ee47e154d5f24f58a6ab5c6f830f73b0eabe8a73c
Instruction ID: 9ff2737b3f115868abc35045696de635fece3b78efbb9eb3296ba5fd037f80c1
Opcode Fuzzy Hash: 043d16d4f16c46e711c3da1ee47e154d5f24f58a6ab5c6f830f73b0eabe8a73c
Instruction Fuzzy Hash: C3D1DE7190020EDADB688F68C855AFEB7F1FF05310F280119EB01ABE91D7759E80EB91

Function 00147B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 000E0242: EnterCriticalSection.KERNEL32(0019070C,00191884,?,?,000D198B,00192518,?,?,?,000C12F9,00000000), ref: 000E024D
Part of subcall function 000E0242: LeaveCriticalSection.KERNEL32(0019070C,?,000D198B,00192518,?,?,?,000C12F9,00000000), ref: 000E028A

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 000E00A3: __onexit.LIBCMT ref: 000E00A9

__Init_thread_footer.LIBCMT ref: 00147BFB

Part of subcall function 000E01F8: EnterCriticalSection.KERNEL32(0019070C,?,?,000D8747,00192514), ref: 000E0202
Part of subcall function 000E01F8: LeaveCriticalSection.KERNEL32(0019070C,?,000D8747,00192514), ref: 000E0235

Strings

G, xrefs: 00147C7F
Variable must be of type 'Object'., xrefs: 00147C3A
5, xrefs: 00147C78

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: f4320d025499215bb034030657a5a79b28f34b74731497c38c79254729964df9
Instruction ID: 50b11673c6e000f57f422b4bfd6d3b2de72804ca89b7037a0f5be6d29aeefad8
Opcode Fuzzy Hash: f4320d025499215bb034030657a5a79b28f34b74731497c38c79254729964df9
Instruction Fuzzy Hash: 61917870A04209EFCB14EF94D991DBDB7B2FF49304F148059F816AB2A2DB71AE85CB51

Function 00122716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0012B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,001221D0,?,?,00000034,00000800,?,00000034), ref: 0012B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00122760

Part of subcall function 0012B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,001221FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0012B3F8

Part of subcall function 0012B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0012B355
Part of subcall function 0012B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00122194,00000034,?,?,00001004,00000000,00000000), ref: 0012B365
Part of subcall function 0012B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00122194,00000034,?,?,00001004,00000000,00000000), ref: 0012B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 001227CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0012281A

Strings

@, xrefs: 00122832

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: b0543f6659b844c0bdff4520ecda633bfcd878c939e7a1a61d27224bea4ea4ab
Instruction ID: 70930119dd3e87963004a217d3f5ebc86fc4ec36f4c91b555ef1675440e5438a
Opcode Fuzzy Hash: b0543f6659b844c0bdff4520ecda633bfcd878c939e7a1a61d27224bea4ea4ab
Instruction Fuzzy Hash: 27412D72900228BFDB10DFA4DD81ADEBBB8EF15300F004059FA55B7181DB706E55CBA0

Function 000F172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 000F1769
_free.LIBCMT ref: 000F1834
_free.LIBCMT ref: 000F183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 000F1760, 000F1767, 000F1796, 000F17CE

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: fd16331fffe92521b29b14be3ce279180464d5f3c51c284caa414dd160e7b248
Instruction ID: 7f61819c330f8462a6a59cbfc0f545b0390fb2cb257e425d46d215a8891373c1
Opcode Fuzzy Hash: fd16331fffe92521b29b14be3ce279180464d5f3c51c284caa414dd160e7b248
Instruction Fuzzy Hash: 3D31B171A0430DFFCB21EB999981DEEBBFCEB84350F244166E60497611DB704A81EB90

Function 0012C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0012C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0012C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00191990,00DC55F0), ref: 0012C395

Strings

0, xrefs: 0012C2DF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: dc44fa1bf618d321511555fac3bb8570c6593337219b7d804a0c28d7e7b4c4f5
Instruction ID: 523b40525d9952b4af78ab7dcca7c7262adc0419d9965458090293cb29807037
Opcode Fuzzy Hash: dc44fa1bf618d321511555fac3bb8570c6593337219b7d804a0c28d7e7b4c4f5
Instruction Fuzzy Hash: 3041BE312043519FD724DF25E884B6EBBE8BF95320F008A1DFAA5972D1D730E914CBA2

Function 00154416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0015CC08,00000000,?,?,?,?), ref: 001544AA
GetWindowLongW.USER32 ref: 001544C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 001544D7

Strings

SysTreeView32, xrefs: 0015447C

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 747af6f29087c012aa78ee1dbd2d111aff8b9a976bd71cbff5207acd95741866
Instruction ID: 008eebb42409e0576dcacfa4fa424bdf95839a0324d4a0a2903df519f44eae17
Opcode Fuzzy Hash: 747af6f29087c012aa78ee1dbd2d111aff8b9a976bd71cbff5207acd95741866
Instruction Fuzzy Hash: 74319A31250205AFDF208E78DC45BEA7BA9EB08329F204315FD79A62E1D770EC949B50

Function 0014304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0014335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00143077,?,?), ref: 00143378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0014307A
_wcslen.LIBCMT ref: 0014309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00143106

Strings

255.255.255.255, xrefs: 00143095, 0014309A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 501d7f57d64639b8abfb233bef6e7deb496c7e982dab56119ad0fea881e2e220
Instruction ID: a4e3dd74fed773adbd3ca7eebdfeab234d7cae1586d240215074856e37dda9e0
Opcode Fuzzy Hash: 501d7f57d64639b8abfb233bef6e7deb496c7e982dab56119ad0fea881e2e220
Instruction Fuzzy Hash: 5B31D335200301DFDB14CF68C585EAA77E0EF54318F258199E9259B7A2DB72EE45C760

Function 00153EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00153F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00153F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00153F78

Strings

SysMonthCal32, xrefs: 00153F0B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 31810c87d906c49b5d74eb1ef302a2e36bbd8866d1ad25982859382db440b486
Instruction ID: 0a8715f2fe0a9095e3f7880640380035eb1b5915da1eb165fb220645fb99a3cb
Opcode Fuzzy Hash: 31810c87d906c49b5d74eb1ef302a2e36bbd8866d1ad25982859382db440b486
Instruction Fuzzy Hash: B121BC32600219BFDF218F90CC46FEA3BB9EB48754F110215FE256B1D0D7B1A9A4CBA0

Function 00154653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00154705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00154713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0015471A

Strings

msctls_updown32, xrefs: 00154684

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 4c31d95b911a3ce46d5df0eeb5b4ea630a0cbd6238381749c004429b2ececc5c
Instruction ID: aa443d9501adfe21d493926a497dd7507c36f0f4683adc80a7ffe76e66c93316
Opcode Fuzzy Hash: 4c31d95b911a3ce46d5df0eeb5b4ea630a0cbd6238381749c004429b2ececc5c
Instruction Fuzzy Hash: 0F219DB5600209EFEB11DF64DCC1DAB37ADEB5A3A9B000059FA109B391CB31EC95CB60

Function 001295AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0012961D

Strings

#notrayicon, xrefs: 001295B7
#requireadmin, xrefs: 001295D9
#OnAutoItStartRegister, xrefs: 001295F3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 68d6086b578d5eb972470ae48190b5f5b6365c0c0aec0d1149f1ba2e862812c8
Instruction ID: ad928abcc11afc8ffc2156ec46df360a1d8a20d7717e3842be08f86c2112a0b5
Opcode Fuzzy Hash: 68d6086b578d5eb972470ae48190b5f5b6365c0c0aec0d1149f1ba2e862812c8
Instruction Fuzzy Hash: 4E215B32204271AAD331AB2DFC02FFB73D89F51300F10402AF949AB142EB919D66C3E5

Function 001537B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00153840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00153850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00153876

Strings

Listbox, xrefs: 0015380F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: d1671245cb824bf490c8afab56ad8b7710bcdec5de20ac3349efe6b1bede9d79
Instruction ID: 574e02928c6f4db7d5f51248f384777508bc7868c7f975050815be77ba51897d
Opcode Fuzzy Hash: d1671245cb824bf490c8afab56ad8b7710bcdec5de20ac3349efe6b1bede9d79
Instruction Fuzzy Hash: FB21B072600218BFEB218F64CC81FAB376AEF89791F108114F9209B190C771DC568BA0

Function 001349F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00134A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00134A5C
SetErrorMode.KERNEL32(00000000,?,?,0015CC08), ref: 00134AD0

Strings

%lu, xrefs: 00134A6F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: b09b3d08d788e1d9d50b8ab80ab044b1be05803fe5b3f1472d7a3839fa313a05
Instruction ID: 0e5db63174e46a988f02dcb8bfa8abe603817a94f7101d25dcce764a3d2a8685
Opcode Fuzzy Hash: b09b3d08d788e1d9d50b8ab80ab044b1be05803fe5b3f1472d7a3839fa313a05
Instruction Fuzzy Hash: D4310F75A00209AFDB10DF54C985EAE7BF8EF05308F148099F909DB252D775ED45CBA1

Function 001541EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0015424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00154264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00154271

Strings

msctls_trackbar32, xrefs: 00154226

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: fb6870eb4be131d63185a13d7aaef574b1b18b731b0d4fee5848c548c3c34228
Instruction ID: 5b6f855c76627bf5a90325cf00ac2cd44854ade436af67b35a9d4144a8241623
Opcode Fuzzy Hash: fb6870eb4be131d63185a13d7aaef574b1b18b731b0d4fee5848c548c3c34228
Instruction Fuzzy Hash: CB11E331240208BFEF205F29DC46FAB3BACEF95B59F110114FA65EA090D371D8919B20

Function 00122F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A

Part of subcall function 00122DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00122DC5
Part of subcall function 00122DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00122DD6
Part of subcall function 00122DA7: GetCurrentThreadId.KERNEL32 ref: 00122DDD
Part of subcall function 00122DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00122DE4

GetFocus.USER32 ref: 00122F78

Part of subcall function 00122DEE: GetParent.USER32(00000000), ref: 00122DF9

GetClassNameW.USER32(?,?,00000100), ref: 00122FC3
EnumChildWindows.USER32(?,0012303B), ref: 00122FEB

Strings

%s%d, xrefs: 00122FFF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 136d2123c2a548f9963da30c590a623b0fff2486d091bb46ef6446261c4c9e76
Instruction ID: 29ee919053ab3be76429d9a3aef2dd747c3e7158eaece97f74d3d6217bae698d
Opcode Fuzzy Hash: 136d2123c2a548f9963da30c590a623b0fff2486d091bb46ef6446261c4c9e76
Instruction Fuzzy Hash: B511E471200319ABCF14BFB09C95EEE37AAAF94304F044079F9199B252DF349A598B70

Function 00155882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 001558C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 001558EE
DrawMenuBar.USER32(?), ref: 001558FD

Strings

0, xrefs: 0015588F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 5c6ad843b3ab2ec261ec47cf2f9bce75ccb6994d0c4b9e6f6c1a306f711d9cab
Instruction ID: 7d0618f89a3d9d2315dbd96690bdd18838041d9f533b5ef3c993916515b91bcb
Opcode Fuzzy Hash: 5c6ad843b3ab2ec261ec47cf2f9bce75ccb6994d0c4b9e6f6c1a306f711d9cab
Instruction Fuzzy Hash: 6B016131500318EFDB119F51DC44BAEBBB5FB45366F108099E859DA261EB348A84DF71

Function 0011D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0011D3BF
FreeLibrary.KERNEL32 ref: 0011D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0011D3B9
X64, xrefs: 0011D2A8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 67a9246ead4631ef90ec1755aafb41c8aa3cf42b837e57bbe9d318bdab56b602
Instruction ID: 843111912f1cd98d8e6a3c2ae258016f35b64ec2cf95ae0fd5d02685cc91741b
Opcode Fuzzy Hash: 67a9246ead4631ef90ec1755aafb41c8aa3cf42b837e57bbe9d318bdab56b602
Instruction Fuzzy Hash: D0F0ECB5415B11DAD77C56109CC89E93314BF11711F658177E033F5095EB70C9C1C692

Function 0012007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa20f8bdc32a29c9d9bf954c5b369f69decf51bbd6bfbc091d69c41e32cf6e24
Instruction ID: 140dc9c4427a502f4f04f1e133e49f68c32d01f4728729ef2b451d28bd17b72d
Opcode Fuzzy Hash: fa20f8bdc32a29c9d9bf954c5b369f69decf51bbd6bfbc091d69c41e32cf6e24
Instruction Fuzzy Hash: A4C18D75A0022AEFDB05CFA4D894EAEB7B5FF48304F118698E405EB252C731ED91CB90

Function 000F3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 000F3F0B
__alldvrm.LIBCMT ref: 000F410C
__alldvrm.LIBCMT ref: 000F412E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 91efaf13b1dabf8f281840a8f8d3a745adcc458b549fbf52d2bee7f068c476b8
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 07A13772E0038A9FDB25CF18C8917BFBBE4EF61350F18416DEA859B682C6788985D750

Function 0014342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00143459
CoUninitialize.OLE32 ref: 00143463
VariantInit.OLEAUT32(?), ref: 0014346E
VariantClear.OLEAUT32(?), ref: 0014371B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: e933915292ed570f540c0832eb9b94bb5214102cbeafa57c54c3f3a1aa1154cc
Instruction ID: d4f2990d62423e16dbac07b43c11ac4cb43829ad6fffd25b553ebb2a4d181417
Opcode Fuzzy Hash: e933915292ed570f540c0832eb9b94bb5214102cbeafa57c54c3f3a1aa1154cc
Instruction Fuzzy Hash: D9A112756047019FCB00DF28C585A6EB7E5EF88724F05885DF99A9B362DB70EE01CB92

Function 00120436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0015FC08,?), ref: 001205F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0015FC08,?), ref: 00120608
CLSIDFromProgID.OLE32(?,?,00000000,0015CC40,000000FF,?,00000000,00000800,00000000,?,0015FC08,?), ref: 0012062D
_memcmp.LIBVCRUNTIME ref: 0012064E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: fad6b786c41c7f8546938e46be20101d73e2b1b78a77f5b13e3c6189e0ca8aa2
Instruction ID: 74666082e43c0e102d0f7c99f6ecfe4c9a757a4207b8a6abcef4088b6c1984f7
Opcode Fuzzy Hash: fad6b786c41c7f8546938e46be20101d73e2b1b78a77f5b13e3c6189e0ca8aa2
Instruction Fuzzy Hash: A9813C71A00219EFCB05DF94C988EEEB7B9FF89315F204558E506AB251DB71AE06CF60

Function 00101391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001014C0

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2c994f5990f25dbd92465ee50ebd3d544c26aa452e2e895c7ba7aa4909eaaeaa
Instruction ID: 4652eee0b3faf86ad37614c447c0efcde027551edf4762597d85d63f4cea990a
Opcode Fuzzy Hash: 2c994f5990f25dbd92465ee50ebd3d544c26aa452e2e895c7ba7aa4909eaaeaa
Instruction Fuzzy Hash: B8413931A00505BFDB256FB98C45AFE3AA4FF52330F144229F958D71E3EBB888419262

Function 00156278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001562E2
ScreenToClient.USER32(?,?), ref: 00156315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00156382

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: cf7aa37cb3f36a3621df46b684cd979d749c9ad3f7c6f0e9666e4e1bdbb2282b
Instruction ID: e32eddbc66bb03d23f336c6588e703a1f37e9a81fea50f6ac3c6e529ce3953c8
Opcode Fuzzy Hash: cf7aa37cb3f36a3621df46b684cd979d749c9ad3f7c6f0e9666e4e1bdbb2282b
Instruction Fuzzy Hash: 2E513D74A00209EFCF10DF68D881AAE7BB5FF55365F508169F8699B2A0D730ED85CB90

Function 00141AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00141AFD
WSAGetLastError.WSOCK32 ref: 00141B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00141B8A
WSAGetLastError.WSOCK32 ref: 00141B94

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 7350b13cb3838a38fa756adafc7d80cc4e35aafcf22c63578a73d96a285850cc
Instruction ID: de808eca79781f852cb17f6ae37c76e9c7391132097e6627b5667ae5bd318dd0
Opcode Fuzzy Hash: 7350b13cb3838a38fa756adafc7d80cc4e35aafcf22c63578a73d96a285850cc
Instruction Fuzzy Hash: EF417B74600300AFE720AF24C886F6A77A5EB44718F54849CF91A9F7D3D772ED828B90

Function 000FB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa26b9a0038ebd457965aadf402db539ef03af945ade92458bcb4317f3f4152d
Instruction ID: 8ef4029f8a1e02ad19b60985b5ab059d78e893697a79cbee99464319d5e06b3a
Opcode Fuzzy Hash: aa26b9a0038ebd457965aadf402db539ef03af945ade92458bcb4317f3f4152d
Instruction Fuzzy Hash: B441E976900708BFD724AF38CD41BBE7BE9EB84710F10452AF651DBA82D775A9019B80

Function 001356D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00135783
GetLastError.KERNEL32(?,00000000), ref: 001357A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 001357CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 001357FA

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 37ca6e10bf80499cccb6ec8d1b68318515751ad0cf7393dc171c95a95453a5bf
Instruction ID: cb0e92969092b4d44ad96ee3edcce2164422ffc7cbc21b11be961ed8967da12c
Opcode Fuzzy Hash: 37ca6e10bf80499cccb6ec8d1b68318515751ad0cf7393dc171c95a95453a5bf
Instruction Fuzzy Hash: BF411739600A10DFCB11EF15C445A5EBBE2EF89720F598498E84AAB362CB70FD41DF91

Function 000FD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,000E6D71,00000000,00000000,000E82D9,?,000E82D9,?,00000001,000E6D71,8BE85006,00000001,000E82D9,000E82D9), ref: 000FD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 000FD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 000FD9AB
__freea.LIBCMT ref: 000FD9B4

Part of subcall function 000F3820: RtlAllocateHeap.NTDLL(00000000,?,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6,?,000C1129), ref: 000F3852

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 0f0833421b00e9986f9bc391eb160dbcc1fa2b18ca91cb720d65ff05d23a97e1
Instruction ID: 800333e01272c33c5e6cf6d94e5971878e2b06d3dc1a670259845a8cab23f6a6
Opcode Fuzzy Hash: 0f0833421b00e9986f9bc391eb160dbcc1fa2b18ca91cb720d65ff05d23a97e1
Instruction Fuzzy Hash: EE31CE72A0020AAFDB259FA5DC45EFE7BA6EB40310B05416AFD04DA151EB75CE50DBA0

Function 001552C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00155352
GetWindowLongW.USER32(?,000000F0), ref: 00155375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00155382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001553A8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 54f38615145cc719df36c6efe18e0f95a45c8edd91cb99ee773a10ef868928b9
Instruction ID: e78f15492936e14a999a339069147b8eb0fa61a4856b8523ca8560d0f9d27364
Opcode Fuzzy Hash: 54f38615145cc719df36c6efe18e0f95a45c8edd91cb99ee773a10ef868928b9
Instruction Fuzzy Hash: 6631B434A55A08EFEB749F14CC25BE83767BB043D2F584112FE299E2E1C7B09988D741

Function 0012AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 0012ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0012AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0012AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 0012ACC6

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: e275dc8c3266b06bc4737ba39e0e89b6846a6ac07d4d248c82eb9b94ccf5461b
Instruction ID: f4af0d687ffba7f4fffba653c7e76c2b9bd81ed11d6b7b080cb0c1110595987c
Opcode Fuzzy Hash: e275dc8c3266b06bc4737ba39e0e89b6846a6ac07d4d248c82eb9b94ccf5461b
Instruction Fuzzy Hash: FB312830A04328AFFF38CF64EC047FE7BA5AF85310F84421AE481562D1C3749AB58792

Function 00157674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0015769A
GetWindowRect.USER32(?,?), ref: 00157710
PtInRect.USER32(?,?,00158B89), ref: 00157720
MessageBeep.USER32(00000000), ref: 0015778C

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 7f46257fa5d0b57ed5d4011eb64d81bcc205696a05a9053bbf202423a061e4d2
Instruction ID: 7735b5eb68cd4792f07715b995a37310c8838926209ed6c65e6301c6f1348354
Opcode Fuzzy Hash: 7f46257fa5d0b57ed5d4011eb64d81bcc205696a05a9053bbf202423a061e4d2
Instruction Fuzzy Hash: 5841AF34605255EFCB02CF58E89AEA977F4FB49306F1540A9E8249F2A1C330A989CF90

Function 001516DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 001516EB

Part of subcall function 00123A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00123A57
Part of subcall function 00123A3D: GetCurrentThreadId.KERNEL32 ref: 00123A5E
Part of subcall function 00123A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001225B3), ref: 00123A65

GetCaretPos.USER32(?), ref: 001516FF
ClientToScreen.USER32(00000000,?), ref: 0015174C
GetForegroundWindow.USER32 ref: 00151752

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 8f743b7c2b4f9e8a555c16edeccf8038bce29b0599a80964236b2615df1a6f5f
Instruction ID: e39e0f7ba58f6ddae5272824f5c4e81efb0b9350a501799bd9d0c371b9ad6cf0
Opcode Fuzzy Hash: 8f743b7c2b4f9e8a555c16edeccf8038bce29b0599a80964236b2615df1a6f5f
Instruction Fuzzy Hash: 53314371D00249AFD700DFA9C881DEEB7F9EF48304B50806DE425E7212D7359E45CBA0

Function 0012DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 000C7620: _wcslen.LIBCMT ref: 000C7625

_wcslen.LIBCMT ref: 0012DFCB
_wcslen.LIBCMT ref: 0012DFE2
_wcslen.LIBCMT ref: 0012E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0012E018

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 0a9114e4f6c60c24a485c22abb998a97820735e641878da6b90917eac5986376
Instruction ID: abfae5d2f51516cd0d025808dab52d14fddd927e8383037a1af5feda1999aa0e
Opcode Fuzzy Hash: 0a9114e4f6c60c24a485c22abb998a97820735e641878da6b90917eac5986376
Instruction Fuzzy Hash: EB21A175900224EFCB209FA8E981BAEB7F8EF45750F144069F805BB286D7709E41CBE5

Function 0012D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0012D501
Process32FirstW.KERNEL32(00000000,?), ref: 0012D50F
Process32NextW.KERNEL32(00000000,?), ref: 0012D52F
CloseHandle.KERNEL32(00000000), ref: 0012D5DC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 167904b49508cd1a0f988b26d9571081539ce83e04d90205edf6ced3b4f4901b
Instruction ID: 89d8c9e9ba4e58502fd5f0b023bf39af2253e79737c76553f1c4cda71f1892f0
Opcode Fuzzy Hash: 167904b49508cd1a0f988b26d9571081539ce83e04d90205edf6ced3b4f4901b
Instruction Fuzzy Hash: 3D317E711083019FD300EF54E885EAFBBF8EF99354F54092DF581861A2EB719999CBA2

Function 00158FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2

GetCursorPos.USER32(?), ref: 00159001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00117711,?,?,?,?,?), ref: 00159016
GetCursorPos.USER32(?), ref: 0015905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00117711,?,?,?), ref: 00159094

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 154f570a801746f7022aeb44770450b0f631019da8c63c48abe7b944f6167111
Instruction ID: cf22a47d30bdf5b855917b3c525a431db38ae4eff93a76b6030cb80bf5059dec
Opcode Fuzzy Hash: 154f570a801746f7022aeb44770450b0f631019da8c63c48abe7b944f6167111
Instruction Fuzzy Hash: 86219F35600118FFCB258F94CC58EEB7BB9EB49352F044555F9154F2A1D3319990EBA1

Function 0012D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0015CB68), ref: 0012D2FB
GetLastError.KERNEL32 ref: 0012D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0012D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0015CB68), ref: 0012D376

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: d5ee4f367fc8018aa335a6c7d8160afedbb6ac53f1de3e25a82a43e1c01cae98
Instruction ID: 7de5004ab907fa81fbd86cfe9ee96c98003c06da25edb7d2fe8a1c59cbf8080e
Opcode Fuzzy Hash: d5ee4f367fc8018aa335a6c7d8160afedbb6ac53f1de3e25a82a43e1c01cae98
Instruction Fuzzy Hash: 0F218DB0508311DF8310DF28E8859AE77E4FF56364F504A1DF499C72A2DB309959CB93

Function 00121571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00121014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0012102A
Part of subcall function 00121014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00121036
Part of subcall function 00121014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00121045
Part of subcall function 00121014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0012104C
Part of subcall function 00121014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00121062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 001215BE
_memcmp.LIBVCRUNTIME ref: 001215E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00121617
HeapFree.KERNEL32(00000000), ref: 0012161E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 27cb08893f6e0cb4468aeb374ebddc55911b81b841cfda1198cceb776dba9141
Instruction ID: d126fd11002577295b32230b9097f9d08f6cdeba1b885667c998cf28184cb005
Opcode Fuzzy Hash: 27cb08893f6e0cb4468aeb374ebddc55911b81b841cfda1198cceb776dba9141
Instruction Fuzzy Hash: 2B219A31E00218FFDF00DFA4D945BEEB7B8EFA4355F188499E441AB241E770AA55CBA0

Function 00152782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0015280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00152824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00152832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00152840

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 8b5ff63868ed516390944280a0fd5d165edf5f75f32135e48680d33cd8619d31
Instruction ID: 31bba675f517956098f32396970f04f6ead17580ba6388db52125dfec78a8eab
Opcode Fuzzy Hash: 8b5ff63868ed516390944280a0fd5d165edf5f75f32135e48680d33cd8619d31
Instruction Fuzzy Hash: 89219032204611EFD714DB24C845FAA7B95AF56325F14815CF8268F6A2C771EC86C7D0

Function 001278F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00128D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0012790A,?,000000FF,?,00128754,00000000,?,0000001C,?,?), ref: 00128D8C
Part of subcall function 00128D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00128DB2
Part of subcall function 00128D7D: lstrcmpiW.KERNEL32(00000000,?,0012790A,?,000000FF,?,00128754,00000000,?,0000001C,?,?), ref: 00128DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00128754,00000000,?,0000001C,?,?,00000000), ref: 00127923
lstrcpyW.KERNEL32(00000000,?), ref: 00127949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00128754,00000000,?,0000001C,?,?,00000000), ref: 00127984

Strings

cdecl, xrefs: 0012797B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 30b9415f2d67cdfe760ff7795d96355d00d370458c26077498110fb1d7cbd198
Instruction ID: d70b34c5b0f10afbbbd4f46f774ee419498087b9d379920309a3baf5129099bb
Opcode Fuzzy Hash: 30b9415f2d67cdfe760ff7795d96355d00d370458c26077498110fb1d7cbd198
Instruction Fuzzy Hash: DA11063A200352AFCF156F34E844D7B77A5FF45364B00402AF906CB3A4EB319861C7A1

Function 00157CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00157D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00157D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00157D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0013B7AD,00000000), ref: 00157D6B

Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: b07def83a732ce2c5b7493330ad9c766716cb3200f902db2e6d88344ddbb0e62
Instruction ID: 5a7aff582a56e7f79f0d2a86fb57e34c2a14909572f3aea7f97950f7522ef3d5
Opcode Fuzzy Hash: b07def83a732ce2c5b7493330ad9c766716cb3200f902db2e6d88344ddbb0e62
Instruction Fuzzy Hash: CB11CD31214755EFCB108FA8EC04AAA3BA5BF45362B114729FC39DB2F0E7319994CB90

Function 00155660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 001556BB
_wcslen.LIBCMT ref: 001556CD
_wcslen.LIBCMT ref: 001556D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00155816

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: af647d079aa09a203a97e73b22a0d42befb2ff658070f527994e19e6ed4c3751
Instruction ID: faedacecb7b079ceddde45aa54d454b7b6c40150e6d5d40cfb788fd7c018558e
Opcode Fuzzy Hash: af647d079aa09a203a97e73b22a0d42befb2ff658070f527994e19e6ed4c3751
Instruction Fuzzy Hash: 2B11D671A00604EADF209F61CC95AEE777CEF10766B104026FD25EE081E770CA88CB60

Function 000F1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c940e285fab9e21298db3c579d14493e46ef47825982cde5a35e9c9e076f7c4d
Instruction ID: 17f1165609386c9880958cafff686437077eeedb8aefa3da2af135f126e44036
Opcode Fuzzy Hash: c940e285fab9e21298db3c579d14493e46ef47825982cde5a35e9c9e076f7c4d
Instruction Fuzzy Hash: 860162B2209A1EBEF7611A786CC1FB766ADDF413B8B341325F721A59D2DB608C4061A0

Function 00121A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00121A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00121A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00121A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00121A8A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 811310a1a073faea1d2f31a124a8ff5fb0b913483f95f63b88b2af4e1bb4b92e
Instruction ID: 2a1c6cc10cb1535b7567c54c1578c6e0190e2377408007e2864dc69f3e32ea59
Opcode Fuzzy Hash: 811310a1a073faea1d2f31a124a8ff5fb0b913483f95f63b88b2af4e1bb4b92e
Instruction Fuzzy Hash: 7411273A901229FFEB10DBA4C985FADBB79EB18750F2000A1EA00B7290D7716E50DB94

Function 0012E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0012E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0012E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0012E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0012E24D

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3d734a48f17922cf81408f9437a9ed0347efa1c29a1790564d02ed5847dd1a2a
Instruction ID: 4b048ef6537beb9f3771a9c4f19a2ca6e3e785e662c5c371fd38efd24893f06f
Opcode Fuzzy Hash: 3d734a48f17922cf81408f9437a9ed0347efa1c29a1790564d02ed5847dd1a2a
Instruction Fuzzy Hash: 36110876904365FFC7019FA8AC05A9E7FADEB45321F10421AF925E7691D3708A808BA0

Function 000ED1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,000ECFF9,00000000,00000004,00000000), ref: 000ED218
GetLastError.KERNEL32 ref: 000ED224
__dosmaperr.LIBCMT ref: 000ED22B
ResumeThread.KERNEL32(00000000), ref: 000ED249

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: b434d752c6325948d743f7add12bbbcfb04c669eaeaabc487adf65799818043c
Instruction ID: 3b61852498900c805f8ae008adc19dc925eaf45c920757402f8faf70ffc9c5de
Opcode Fuzzy Hash: b434d752c6325948d743f7add12bbbcfb04c669eaeaabc487adf65799818043c
Instruction Fuzzy Hash: B8012636805248BFC7205FA7DC05BAE3B69EF81331F10025EFA24A61D1CB718841D6A0

Function 00159EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2

GetClientRect.USER32(?,?), ref: 00159F31
GetCursorPos.USER32(?), ref: 00159F3B
ScreenToClient.USER32(?,?), ref: 00159F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00159F7A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 7d27850be2ca19ba5cd471b81016308e304606d0160971b6c243623f448f5e5e
Instruction ID: 3af81749f620605511d4e4df0fb64f1527545c141a53049cebc88f816d47ae4e
Opcode Fuzzy Hash: 7d27850be2ca19ba5cd471b81016308e304606d0160971b6c243623f448f5e5e
Instruction Fuzzy Hash: F911183290021AEFDB10DFA9D8859EE7BB9FB45312F400456F921EB551D730BA85CBE2

Function 000C600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000C604C
GetStockObject.GDI32(00000011), ref: 000C6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 000C606A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 43ad090990e3f323d80fdff850e9843c3206a44b05aad776b21f13872f2660f9
Instruction ID: 1287eeaf26e87f2f87df580236384bf742f0935efe4cb483226055f0253edbeb
Opcode Fuzzy Hash: 43ad090990e3f323d80fdff850e9843c3206a44b05aad776b21f13872f2660f9
Instruction Fuzzy Hash: DA115E72501609FFEF224F949C54FEF7BA9EF1C355F150115FA1466150D732ACA09B90

Function 000E3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 000E3B56

Part of subcall function 000E3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 000E3AD2
Part of subcall function 000E3AA3: ___AdjustPointer.LIBCMT ref: 000E3AED

_UnwindNestedFrames.LIBCMT ref: 000E3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 000E3B7C
CallCatchBlock.LIBVCRUNTIME ref: 000E3BA4

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: c29a8c94b6cfaf17b75cc823f3b5dc4f8d5095e70e9e3b454a061cd1d8282620
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: D7010072100189BFDF125E96CC46DEB7F6DEF98754F044054FE4866122C736D961DBA0

Function 000F3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,000C13C6,00000000,00000000,?,000F301A,000C13C6,00000000,00000000,00000000,?,000F328B,00000006,FlsSetValue), ref: 000F30A5
GetLastError.KERNEL32(?,000F301A,000C13C6,00000000,00000000,00000000,?,000F328B,00000006,FlsSetValue,00162290,FlsSetValue,00000000,00000364,?,000F2E46), ref: 000F30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,000F301A,000C13C6,00000000,00000000,00000000,?,000F328B,00000006,FlsSetValue,00162290,FlsSetValue,00000000), ref: 000F30BF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ff07ab37262f860fc2557e2879dcb3638503e50973fbb78ceb9241d9035d9ae2
Instruction ID: 53ac30f2727a46e474d74fc2f41a2414431a5e6f4fad5538246ab4a681c15bc7
Opcode Fuzzy Hash: ff07ab37262f860fc2557e2879dcb3638503e50973fbb78ceb9241d9035d9ae2
Instruction Fuzzy Hash: 0801D43230132AEFCB714AB99C54A7B7BD8AF05BB1B100621FA05E7A40CF21D981D6E0

Function 00127464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0012747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00127497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 001274AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 001274CA

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: e0d782357d96183525a9970bf71ad673c62f5da785eb7c7dd8b19098ab955b4d
Instruction ID: 9d8086fe413ae227ab718cfb27d500ed43ed01ce1fa985791dede7bef7940d57
Opcode Fuzzy Hash: e0d782357d96183525a9970bf71ad673c62f5da785eb7c7dd8b19098ab955b4d
Instruction Fuzzy Hash: 1011C0B1209360EFE720AF14EC08FA37FFCEB00B00F108569A616DA591D7B0E954DBA1

Function 0012B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0012ACD3,?,00008000), ref: 0012B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0012ACD3,?,00008000), ref: 0012B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0012ACD3,?,00008000), ref: 0012B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0012ACD3,?,00008000), ref: 0012B126

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 127bae2073eef5212a4aec2389173524c9b03542aa48fa38a4bda71aba130080
Instruction ID: 8b604d23a39c10258e0c71522f56c6206ee31d21a667480fc0f9c3630310d499
Opcode Fuzzy Hash: 127bae2073eef5212a4aec2389173524c9b03542aa48fa38a4bda71aba130080
Instruction Fuzzy Hash: 0E113C71C05A39DBCF04AFA4F9A86EEBB78FF09711F114085D941B6141CB3056608B95

Function 00157E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00157E33
ScreenToClient.USER32(?,?), ref: 00157E4B
ScreenToClient.USER32(?,?), ref: 00157E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00157E8A

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 47c7042000d0ff6a0e89fa9e5e34e3cefcc10b5a25749bbaf7112c66411c214f
Instruction ID: 20b76d947c6cba400b91e069236fd0eb6c71874a52d5f973648dc3b81018dc83
Opcode Fuzzy Hash: 47c7042000d0ff6a0e89fa9e5e34e3cefcc10b5a25749bbaf7112c66411c214f
Instruction Fuzzy Hash: 151163B9D0024AEFDB41CF98C8859EEBBF5FB08311F104056E911E6610D734AA94CF90

Function 00122DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00122DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00122DD6
GetCurrentThreadId.KERNEL32 ref: 00122DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00122DE4

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: fe62b11faf6eebfd1ff1998d2e3d8a3bbba2f1127e531f70895fa90fb17243ff
Instruction ID: 5380fb42fb313400a98b59ace4d83c881a7bb8eea34c155c187364d76db16aaa
Opcode Fuzzy Hash: fe62b11faf6eebfd1ff1998d2e3d8a3bbba2f1127e531f70895fa90fb17243ff
Instruction Fuzzy Hash: 50E06D72101338BBD7201BB2AC0DEEB3E6CEB42BA2F000015F105D95809AA48980C6F0

Function 00158863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 000D9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 000D9693
Part of subcall function 000D9639: SelectObject.GDI32(?,00000000), ref: 000D96A2
Part of subcall function 000D9639: BeginPath.GDI32(?), ref: 000D96B9
Part of subcall function 000D9639: SelectObject.GDI32(?,00000000), ref: 000D96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00158887
LineTo.GDI32(?,?,?), ref: 00158894
EndPath.GDI32(?), ref: 001588A4
StrokePath.GDI32(?), ref: 001588B2

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: b162f5da58bd7644744c4d41e9fe985549d364f8696e15ff2416bd6e9d59aca3
Instruction ID: 6545be7ec4a0f443d010cb5797108fecc51821cead222d374c7e470d1698f754
Opcode Fuzzy Hash: b162f5da58bd7644744c4d41e9fe985549d364f8696e15ff2416bd6e9d59aca3
Instruction Fuzzy Hash: 7DF05E3A041359FEDB126F94AC09FCE3F59AF06312F048001FA21694E2C7755591CFE5

Function 000D98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 000D98CC
SetTextColor.GDI32(?,?), ref: 000D98D6
SetBkMode.GDI32(?,00000001), ref: 000D98E9
GetStockObject.GDI32(00000005), ref: 000D98F1

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 39645783c03668560f5a75dd4a5b5b7dfed226c259317220db9cef907625adf1
Instruction ID: baa82235b9ca9b3b9af8662e25601c4e15d631cbe32a8aa3b1eb3dad159c1b06
Opcode Fuzzy Hash: 39645783c03668560f5a75dd4a5b5b7dfed226c259317220db9cef907625adf1
Instruction Fuzzy Hash: 6CE06D31244780EEDB215F78AC09BE83F61AB52336F04822AF6FA585E1C77146809B21

Function 0012162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00121634
OpenThreadToken.ADVAPI32(00000000,?,?,?,001211D9), ref: 0012163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,001211D9), ref: 00121648
OpenProcessToken.ADVAPI32(00000000,?,?,?,001211D9), ref: 0012164F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: fe09611abc96e9289b93defb5327a4392ac0b843650aa8afca744ecf548353d7
Instruction ID: 17a9d7aa1a0c289c449be4845a2e8ace485ab1f83db82fc57ea32d14d129dadf
Opcode Fuzzy Hash: fe09611abc96e9289b93defb5327a4392ac0b843650aa8afca744ecf548353d7
Instruction Fuzzy Hash: EFE04F75602321EFD7601FA0AD0DB4B3B68AF54B92F144808F245CD080D7644480C790

Function 0011D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0011D858
GetDC.USER32(00000000), ref: 0011D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0011D882
ReleaseDC.USER32(?), ref: 0011D8A3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 39e853c2837c7551c4b2944be67eb4dec6ca6df04b817a8b29fc40e3a0af8d8d
Instruction ID: 9a3924759927e36a0dca458ba588ee91214ebe4874df88ef21ea076839b43e28
Opcode Fuzzy Hash: 39e853c2837c7551c4b2944be67eb4dec6ca6df04b817a8b29fc40e3a0af8d8d
Instruction Fuzzy Hash: 62E01AB4800304DFCF419FA0D808A6DBBB1FB08312F108019F80AEB750C7384A82EF90

Function 0011D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0011D86C
GetDC.USER32(00000000), ref: 0011D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0011D882
ReleaseDC.USER32(?), ref: 0011D8A3

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3a953013b4ff34061b98cfb0fe1c8679e0148057d477d9d6b51dfc50a572b53c
Instruction ID: 08a75bbb2edbfb1cc04651fac4bcf8c057427ab7c7a0fbd6f2482ec3e94e6f0e
Opcode Fuzzy Hash: 3a953013b4ff34061b98cfb0fe1c8679e0148057d477d9d6b51dfc50a572b53c
Instruction Fuzzy Hash: BBE09A75800304DFCF519FA0D808A6DBBB5FB48712B148459F94AEB750C7385A42EF90

Function 00134D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 000C7620: _wcslen.LIBCMT ref: 000C7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00134ED4

Strings

LPT, xrefs: 00134DFB
*, xrefs: 00134E10

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 79d49c5ab5e273d30a1ae8a8f1e7564941aebc3f4825ed0678175601b83f0a61
Instruction ID: 24ebeaa50edb660d248db61a0ccb75f3532bc65f69eb284c82933b61b7ac9c2f
Opcode Fuzzy Hash: 79d49c5ab5e273d30a1ae8a8f1e7564941aebc3f4825ed0678175601b83f0a61
Instruction Fuzzy Hash: CD916C75A002049FCB14DF58C484EAEBBF5BF49304F198099E84A9F3A2C775EE85CB90

Function 000EE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 000EE30D

Strings

pow, xrefs: 000EE2E5, 000EE302

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 4adeffd14eb6958e17bbefbecd319c10e827a64c21c268e094347c8d824e7be0
Instruction ID: c54ebbc3772fa74029bb4fb1705591589a0170d3315e1822c3eb4bf75e924392
Opcode Fuzzy Hash: 4adeffd14eb6958e17bbefbecd319c10e827a64c21c268e094347c8d824e7be0
Instruction Fuzzy Hash: 0651C061A0C18E9ACB257B25CD053BD3BE4EB40740F3049A9E1D953AE9EB308CC1AA43

Function 000DE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 000DE1B1

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 8187b00142ad664cfc25e8b2d44445ed6cfc520d7e5d66ade6b121dfa12f4fbb
Instruction ID: 5ef1341e69ab29ea2f6c44a2419b71fb2108e780664abfd71c634dfaa6df2d66
Opcode Fuzzy Hash: 8187b00142ad664cfc25e8b2d44445ed6cfc520d7e5d66ade6b121dfa12f4fbb
Instruction Fuzzy Hash: D351E1359043869EEB19EFA8C481AFE7BE4EF55310F64406AEC519B2D1D7309D82CBA0

Function 000DF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 000DF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 000DF2BB

Strings

@, xrefs: 000DF2AF

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 808a3428b67e5f424018dd9b21b56acb24ea369a41d4380c15a7adf652f861f4
Instruction ID: 8ff3cce9c03feabd3c2b0badf5a327817842ebd4fe15aff87daa0fc1813827ce
Opcode Fuzzy Hash: 808a3428b67e5f424018dd9b21b56acb24ea369a41d4380c15a7adf652f861f4
Instruction Fuzzy Hash: 75513771408744ABE320AF14DC86BAFBBF8FB84300F81885DF1D941196EB718569CB67

Function 00145745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 001457E0
_wcslen.LIBCMT ref: 001457EC

Strings

CALLARGARRAY, xrefs: 001457E6, 001457EB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 54422ec37ba017a2a6dd06b8b2f8a9dbf9cb71faae6470a538a45508e8478507
Instruction ID: b651d68b735c9721f051c698207b020c3398757f9d6c050ae90a3679b60d86d6
Opcode Fuzzy Hash: 54422ec37ba017a2a6dd06b8b2f8a9dbf9cb71faae6470a538a45508e8478507
Instruction Fuzzy Hash: 9F419471E0020ADFCB14DFA9C8859FEBBB6FF59314F104069E515A72A2DB309D81CBA0

Function 0013D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0013D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0013D13A

Strings

|, xrefs: 0013D10B

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 84cdd07f045366bd764225303bdfef2828610c7a2ff19fb1908aaf9e95f1117c
Instruction ID: 2b4866ce4bfa2f9f6c2f199037c7bfe1a6eb1ff9f4f5245806c27b87c86f2203
Opcode Fuzzy Hash: 84cdd07f045366bd764225303bdfef2828610c7a2ff19fb1908aaf9e95f1117c
Instruction Fuzzy Hash: 45313D71D00209ABCF15EFA5DC85EEE7FB9FF04300F000059F815A6162DB32AA56CB60

Function 0015356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00153621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0015365C

Strings

static, xrefs: 001535BC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 0c76ab23698f8e2f772c266bed7d432bfda8e58686e417d3f56b74bf5506a115
Instruction ID: c6f39ef7acc13139873eebce04692700a3a61c6ceb52cc5bc3c067ccae055ba4
Opcode Fuzzy Hash: 0c76ab23698f8e2f772c266bed7d432bfda8e58686e417d3f56b74bf5506a115
Instruction Fuzzy Hash: EF317A71110604AEDB109F28D880EFB73A9FF88761F10961DF8B59B290DB31A9869760

Function 00154537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0015461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00154634

Strings

', xrefs: 0015458E

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 7fcfe72eb8cce06ef911cc510c994c06f78d5721caecdbc8de31160c7b98bb0a
Instruction ID: 2e43ca9b1203facc0503bcc1d06375fa905289b2da9dc896bb1377f2a36fa5f0
Opcode Fuzzy Hash: 7fcfe72eb8cce06ef911cc510c994c06f78d5721caecdbc8de31160c7b98bb0a
Instruction Fuzzy Hash: 6D311674A0130AEFDB14CFA9C990BDA7BB5FB09305F10406AED14AB341E770A985CF90

Function 001531EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0015327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00153287

Strings

Combobox, xrefs: 00153249

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 9a247d441a60a5547de56ed437399b734c5015ca05fe7a2111df6b186ab3fda9
Instruction ID: 45f4be2c4ef013517de6c0e189b89fecc169478a8b5c004bcb99ea0d336640dd
Opcode Fuzzy Hash: 9a247d441a60a5547de56ed437399b734c5015ca05fe7a2111df6b186ab3fda9
Instruction Fuzzy Hash: 7A11B271300608BFEF259F54DC80EFB376AEB943A5F104129F938AB290D7319D959760

Function 00153710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 000C600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000C604C
Part of subcall function 000C600E: GetStockObject.GDI32(00000011), ref: 000C6060
Part of subcall function 000C600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 000C606A

GetWindowRect.USER32(00000000,?), ref: 0015377A
GetSysColor.USER32(00000012), ref: 00153794

Strings

static, xrefs: 00153757

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 521ad57226d8a94aad1ecf84798a4b8b519991dd7ebefc47e2353176ba285585
Instruction ID: bb44183cfedf7894bee1570878b5663cfd9ad8706f2a466a09a1775c61e473ab
Opcode Fuzzy Hash: 521ad57226d8a94aad1ecf84798a4b8b519991dd7ebefc47e2353176ba285585
Instruction Fuzzy Hash: B11159B2A1020AEFDB00DFA8CC45EEA7BB8FB08345F004514FD65E7250E735E8559B50

Function 0013CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0013CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0013CDA6

Strings

<local>, xrefs: 0013CD66

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: e6b5e2c621bd1fd984527b197a919a8a5bd24e59ea644c76b3f57ccdf2ef7cd8
Instruction ID: ee290d228ee05edcdbb6aa1e288183b14e8bf88a2a9ae16061f54ade5f1a08a4
Opcode Fuzzy Hash: e6b5e2c621bd1fd984527b197a919a8a5bd24e59ea644c76b3f57ccdf2ef7cd8
Instruction Fuzzy Hash: 7D11C275205631BAD7384FA68C49EE7BEACEF127A4F00422AB109A7080D7709940D7F0

Function 00153429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 001534AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 001534BA

Strings

edit, xrefs: 0015348F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 30f2651b59b558c6f953a82a7177b2363e70cd088670b06efc3bbe9e526064d3
Instruction ID: 5beccc9d688042092cdec4c695868b6844016ac3140560ec16448efe1616add5
Opcode Fuzzy Hash: 30f2651b59b558c6f953a82a7177b2363e70cd088670b06efc3bbe9e526064d3
Instruction Fuzzy Hash: D7116D71100208EFEB124E64DC44AEB376AEB153B5F504724FD719B1D0C771DD999750

Function 00126C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00126CB6
_wcslen.LIBCMT ref: 00126CC2

Strings

STOP, xrefs: 00126CBC, 00126CC1

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 163895b2398689ef0ad1d06249aeb851499942605ad63591df60b29def3b14fd
Instruction ID: 98af179847d0cc5088e532365c7a6b6a0e183187fad9ba0b5cab2e343669eb3d
Opcode Fuzzy Hash: 163895b2398689ef0ad1d06249aeb851499942605ad63591df60b29def3b14fd
Instruction Fuzzy Hash: CA01D232A0053A8BCB20AFFDEC819BF77B5EB617547510529E8A2A71D1EB31D960C690

Function 00121CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00121D4C

Strings

ListBox, xrefs: 00121D16
ComboBox, xrefs: 00121CEB

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ba0f74c944c152b7c4e8ac2413b45e3f5a899363919bf326e6030f56304ca1cb
Instruction ID: aa5358293a4df2c7745149b34660b30f2803a207fc7e4139105acb24b16f1885
Opcode Fuzzy Hash: ba0f74c944c152b7c4e8ac2413b45e3f5a899363919bf326e6030f56304ca1cb
Instruction Fuzzy Hash: 8C01D875601228FBCB08EFE4EC59DFE7769EB66350B44091AF832573C2EB3059288760

Function 00121BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00121C46

Strings

ListBox, xrefs: 00121C10
ComboBox, xrefs: 00121BE5

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 7d12105283d3ef7ada983e907850633ab0d256fec9ff24f05d6ce34548604f56
Instruction ID: 3865505470f60baca1d3fd0afd6397d4ee4423f644069c3e7eff138c64121e2d
Opcode Fuzzy Hash: 7d12105283d3ef7ada983e907850633ab0d256fec9ff24f05d6ce34548604f56
Instruction Fuzzy Hash: 1F0167756811187BCB18FB90E956EFF77A99B25340F140019A416772C2EB249F3C87B5

Function 00121C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00121CC8

Strings

ListBox, xrefs: 00121C94
ComboBox, xrefs: 00121C69

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e08e11b215195d62e760495ac1e1a301e810f25ea35dc5b11eb81643b2220e97
Instruction ID: 7f4740ebbab7bd4f1c9f65ac77f444f3086315226b7e81e964e64167b707a798
Opcode Fuzzy Hash: e08e11b215195d62e760495ac1e1a301e810f25ea35dc5b11eb81643b2220e97
Instruction Fuzzy Hash: AA01D67568022877CB04FBA0DA56EFE77A99B31340F540029B81273282EB209F38C7B1

Function 00121D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD

Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00121DD3

Strings

ListBox, xrefs: 00121DA0
ComboBox, xrefs: 00121D75

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 6e87fb6a26dfb9950ba024ec428052cdcbf942f9d79cc4af0d3393a0bcbfe1fa
Instruction ID: 3a26d6819d5d38b8a0739aa145ffdbb171f5be3535e7b42b8a82c896d23fdeb9
Opcode Fuzzy Hash: 6e87fb6a26dfb9950ba024ec428052cdcbf942f9d79cc4af0d3393a0bcbfe1fa
Instruction Fuzzy Hash: 58F0A971A41228B7D714FBE4DC5AFFE7768AB21350F440919B432672C2DB605A288660

Function 0014747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00147493
_wcslen.LIBCMT ref: 001474B9

Strings

3, 3, 16, 1, xrefs: 00147483

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: d6b4e08805b5855b4ef86875176dfffff6bf421ff332bf280ae3fea6705678c4
Instruction ID: 72aba16aeedd1d01038284d9b7c35ba7109720ec8f98a045a7d31c865c76579d
Opcode Fuzzy Hash: d6b4e08805b5855b4ef86875176dfffff6bf421ff332bf280ae3fea6705678c4
Instruction Fuzzy Hash: D8E02B02204260149231227AACC19BF5789DFC9750718182BF981E22F7EB94CD9193F1

Function 00120B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00120B23

Strings

Error allocating memory., xrefs: 00120B1C
AutoIt, xrefs: 00120B17

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 72833e9d236d79c60677b0f6e4ded0598d639de24dfc8b37e0d8f6ef3d2c8873
Instruction ID: b497d935ceefffc428ef07f9e164a95eecf8f1c96e060d0721c1ec1b944a6195
Opcode Fuzzy Hash: 72833e9d236d79c60677b0f6e4ded0598d639de24dfc8b37e0d8f6ef3d2c8873
Instruction Fuzzy Hash: 65E0D8312443186ED2203B957C03FC97B85CF09F55F10446BFB58695C38BE2259046E9

Function 000E0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000DF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,000E0D71,?,?,?,000C100A), ref: 000DF7CE

IsDebuggerPresent.KERNEL32(?,?,?,000C100A), ref: 000E0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,000C100A), ref: 000E0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000E0D7F

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 156779dc952e715e7b1003198834865cce243b7c3e435bab9b8b8eee3315e589
Instruction ID: 08ab6df9a05a67394b15aa1910d59a637a69fed563120ebcd7b97bef85a15c3b
Opcode Fuzzy Hash: 156779dc952e715e7b1003198834865cce243b7c3e435bab9b8b8eee3315e589
Instruction Fuzzy Hash: 5EE06D74204341CFD3609FB9D8087967BE0EB00745F01892DE892DAA52DBF5E4C8CBA1

Function 00133017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0013302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00133044

Strings

aut, xrefs: 00133038

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: bb0a4b263bd1f94c1ab6597c5797734549a94ebdea0d5f6888f685b8c736f158
Instruction ID: cc353d65736244ba903f87a252715e13502367cb71728f32843b77112e07f335
Opcode Fuzzy Hash: bb0a4b263bd1f94c1ab6597c5797734549a94ebdea0d5f6888f685b8c736f158
Instruction Fuzzy Hash: 13D05E72500328ABDA20ABA4AC4EFCB7A7CDB04751F0002A1B655E6491EAB09A84CBD0

Function 0011D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0011D220

Strings

%.3d, xrefs: 0011D22B
X64, xrefs: 0011D2A8

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 0d8d623c6b9dd0b18be798a3fc7de17b52d25feff83a3d294fed470b0952ee59
Instruction ID: eb8bce1e9d741ea56f71f1d972f71fec7e4d409eb0fa8694b2249e15763d7e85
Opcode Fuzzy Hash: 0d8d623c6b9dd0b18be798a3fc7de17b52d25feff83a3d294fed470b0952ee59
Instruction Fuzzy Hash: 8AD01261808219E9CB5C96D0EC459F9B37CFB19341F618473F81791040E734D5886B62

Function 00152322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0015232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0015233F

Part of subcall function 0012E97B: Sleep.KERNELBASE ref: 0012E9F3

Strings

Shell_TrayWnd, xrefs: 00152325

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 70919e921e63da2cc57065d570b3a1c4076534c08e75faf376317b76987081c9
Instruction ID: 424b2878ce6d68d5f28f374a3464f64698d356b7b3d6766036641e7a4be95276
Opcode Fuzzy Hash: 70919e921e63da2cc57065d570b3a1c4076534c08e75faf376317b76987081c9
Instruction Fuzzy Hash: 07D0C976394310BAE668BB70AC1FFC67A549B10B15F0049167645AA1D0DAA0A8818A94

Function 00152356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0015236C
PostMessageW.USER32(00000000), ref: 00152373

Part of subcall function 0012E97B: Sleep.KERNELBASE ref: 0012E9F3

Strings

Shell_TrayWnd, xrefs: 00152365

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 4de10fde497dec0545b21316b532e9d451703b2be8dc65781d2b7568eea57185
Instruction ID: 3665c2c9e7e03b31a58c0e280893813c81cebe220cc8f8a6cc2793fe9b8246c7
Opcode Fuzzy Hash: 4de10fde497dec0545b21316b532e9d451703b2be8dc65781d2b7568eea57185
Instruction Fuzzy Hash: 88D0C9723D1310BEE668BB70AC1FFC676549B14B15F4049167645AA1D0DAA0A8818A94

Function 000FBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 000FBE93
GetLastError.KERNEL32 ref: 000FBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 000FBEFC

Memory Dump Source

Source File: 00000000.00000002.2895537855.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.2895516540.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895633684.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895690575.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895719498.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 7ea89eafef56f0bd70ae3cc4e3c041059ac361ccd8ce3e2a506c416288021723
Instruction ID: 0404d657a9bc5467b117c5579d690e834103ce724a262660a2ed0071fd0dcaa7
Opcode Fuzzy Hash: 7ea89eafef56f0bd70ae3cc4e3c041059ac361ccd8ce3e2a506c416288021723
Instruction Fuzzy Hash: 4641C13460420AEFCB718F65CC44ABA7BE5EF41320F294169FA599B5A2DB318D04EF60

Source: Joe Sandbox View	IP Address: 13.107.246.64 13.107.246.64
Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=4839256027653960672&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1Host: arc.msn.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725549854&P2=404&P3=2&P4=dcKdhpSfkT5msp%2f6XO5uLNteytiH9SJ2NiW2YvvdwjhPJz8s8d4bjtkfZgwyN%2bkNG0juB9rgoq86xOXyL4iYfg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: s12wh6zBt+PqlbI3Jzl4UoSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveContent-Length: 466Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=4839256027653960672&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1Host: arc.msn.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x7wvDNpW4uDZky9&MD=92YTSceG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725549854&P2=404&P3=2&P4=dcKdhpSfkT5msp%2f6XO5uLNteytiH9SJ2NiW2YvvdwjhPJz8s8d4bjtkfZgwyN%2bkNG0juB9rgoq86xOXyL4iYfg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: s12wh6zBt+PqlbI3Jzl4UoSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x7wvDNpW4uDZky9&MD=92YTSceG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.60.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.60.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.60.91
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.60.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.60.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.60.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.60.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.60.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.60.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.60.91
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\07d596ae-fad2-483c-90de-931778fb1fa4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\10f6474e-6c76-49c8-a80b-93c32fd8aaf7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1ae0279d-b721-47b6-8723-d9e2ad66edf1.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\44f56bce-714a-4924-8aba-c0e3734f03e4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\50b2cc96-55f9-450e-8299-f3721dfd883a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5a5e6458-0ed4-4071-b3af-b07f528adfb8.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\913cea49-d0e6-4402-82ac-3d834184428b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\98102570-9e1b-428d-8893-2323072412e6.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\ce80363b-ee5c-434f-aa7b-1f6b4fa48246.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D0928A-1D90.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D0928B-1E98.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1fae9231-cd83-4bfc-b986-f600a05ee80e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3cefd7d4-b84b-41ad-9089-d89bcacc54fe.tmp

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre