Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1501397
MD5:	21ba5e866bfd9eb0051f4d3648713c62
SHA1:	ef4b86c59b78ec4862f204d379b51f00948196a0
SHA256:	549fb617ae94c424ffd4f26fc3baba95dfce69cd5af791da698e0bfa59a50bff
Tags:	exe
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7048 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 21BA5E866BFD9EB0051F4D3648713C62)

msedge.exe (PID: 600 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5568 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2000,i,7636510567256851509,10520198468140102036,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5344 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7420 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8556 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8564 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6780 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8640 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6456 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8660 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6456 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9164 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5016 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8352 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4400 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8704 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8708 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 2088 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6992 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2060,i,7639777188277879245,14507477756352778342,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8116 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7256 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2052,i,13957771877731099850,4999353375975219962,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8096 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1656 --field-trial-handle=2128,i,1638324006078571582,16515703826543556908,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.3062763548.0000000001730000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3062763548.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 52b9679f-1b48-4681-ab3d-7cae8a9db777.tmp.15.dr, Network Persistent State.14.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.14.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.14.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: a83ec1d0-735a-4605-8447-a0e195028c15.tmp.15.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.14.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: a83ec1d0-735a-4605-8447-a0e195028c15.tmp.15.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.14.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.3062687352.0000000001560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: content_new.js.14.dr, content.js.14.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: a83ec1d0-735a-4605-8447-a0e195028c15.tmp.15.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.14.dr, Top Sites.4.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.14.dr, Top Sites.4.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49797 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C2EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00C2EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C2ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00C2ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_00C2EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C1AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00C1AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C49576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00C49576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fcddf718-a
Source: file.exe, 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_bd4b5977-f
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_8d1dc338-2
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_18a8bc6d-6

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C1D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00C1D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C11201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00C11201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C1E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00C1E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C22046	0_2_00C22046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB8060	0_2_00BB8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C18298	0_2_00C18298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEE4FF	0_2_00BEE4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE676B	0_2_00BE676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C44873	0_2_00C44873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BDCAA0	0_2_00BDCAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBCAF0	0_2_00BBCAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCCC39	0_2_00BCCC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE6DD9	0_2_00BE6DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB91C0	0_2_00BB91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCB119	0_2_00BCB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD1394	0_2_00BD1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD1706	0_2_00BD1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD781B	0_2_00BD781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD19B0	0_2_00BD19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB7920	0_2_00BB7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC997D	0_2_00BC997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD7A4A	0_2_00BD7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD7CA7	0_2_00BD7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD1C77	0_2_00BD1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE9EEE	0_2_00BE9EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3BE44	0_2_00C3BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD1F32	0_2_00BD1F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00BD0A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00BCF9F2 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.evad.winEXE@96/529@20/10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C237B5 GetLastError,FormatMessageW,

0_2_00C237B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C110BF AdjustTokenPrivileges,CloseHandle,		0_2_00C110BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C116C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00C116C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C251CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00C251CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C3A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00C3A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C2648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00C2648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00BB42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\96bad79a-4c9e-4371-a878-248af6a1abc5.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.14.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2000,i,7636510567256851509,10520198468140102036,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6780 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6456 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6456 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4400 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2060,i,7639777188277879245,14507477756352778342,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2052,i,13957771877731099850,4999353375975219962,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1656 --field-trial-handle=2128,i,1638324006078571582,16515703826543556908,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2000,i,7636510567256851509,10520198468140102036,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6780 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6456 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6456 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4400 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2052,i,13957771877731099850,4999353375975219962,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2060,i,7639777188277879245,14507477756352778342,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2052,i,13957771877731099850,4999353375975219962,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1656 --field-trial-handle=2128,i,1638324006078571582,16515703826543556908,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00BB42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD0A76 push ecx; ret

0_2_00BD0A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00BCF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C41C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00C41C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95045

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6318

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\file.exe TID: 404

Thread sleep time: -63180s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6318 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C1DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00C1DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C268EE FindFirstFileW,FindClose,	0_2_00C268EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00C2698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C1D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00C1D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C1D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00C1D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C29642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C29642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C2979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C29B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00C29B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C25C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00C25C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00BB42DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-95167

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C2EAA2 BlockInput,

0_2_00C2EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BE2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00BE2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00BB42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD4CE8 mov eax, dword ptr fs:[00000030h]

0_2_00BD4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C10B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00C10B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BE2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BD083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD09D5 SetUnhandledExceptionFilter,	0_2_00BD09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BD0C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00C11201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00BF2BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C1B226 SendInput,keybd_event,

0_2_00C1B226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C322DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00C322DA

Source: C:\Users\user\Desktop\file.exe

0_2_00C10B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C11663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00C11663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD0698 cpuid

0_2_00BD0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C28195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00C28195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C0D27A GetUserNameW,

0_2_00C0D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BEBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00BEBB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00BB42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C31204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00C31204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C31806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00C31806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://clients2.googleusercontent.com/crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	URL Reputation	safe
https://msn.com	0%	Avira URL Cloud	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.185.97	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.14.dr, Top Sites.4.dr	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	52b9679f-1b48-4681-ab3d-7cae8a9db777.tmp.15.dr, Network Persistent State.14.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.14.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.14.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.14.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.14.dr, Top Sites.4.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.14.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.14.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.14.dr	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.14.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.14.dr, content.js.14.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.14.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.14.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.14.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.14.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.14.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	a83ec1d0-735a-4605-8447-a0e195028c15.tmp.15.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.14.dr	false	Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.3062687352.0000000001560000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.14.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
142.251.40.206	unknown	United States	15169	GOOGLEUS	false
142.250.64.68	unknown	United States	15169	GOOGLEUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.72.110	unknown	United States	15169	GOOGLEUS	false
142.250.185.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501397
Start date and time:	2024-08-29 21:26:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@96/529@20/10
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 42 Number of non-executed functions: 311
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 66.102.1.84, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.145, 2.19.126.152, 142.250.185.131, 142.250.186.35, 2.23.209.137, 2.23.209.187, 2.23.209.186, 2.23.209.189, 2.23.209.182, 2.23.209.183, 2.23.209.185, 2.23.209.131, 2.23.209.140, 20.103.156.88, 42.56.77.10, 192.229.221.95, 142.250.186.174, 142.250.185.170, 142.250.181.234, 142.250.185.74, 142.250.74.202, 142.250.186.106, 142.250.185.202, 142.250.185.106, 172.217.18.106, 216.58.212.170, 142.250.185.138, 142.250.186.74, 142.250.184.234, 142.250.186.170, 142.250.186.42, 172.217.16.138, 142.250.185.234, 142.250.80.99, 142.251.41.3, 142.251.40.131, 142.250.72.99, 142.250.80.35, 142.250.81.227
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-000
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
20:27:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
20:27:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
20:27:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
20:27:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	OJO!!! No lo he abiertoFwd_ Message From 646___xbx2.eml	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	Stacey Opted PYMT Tokyo electron limited.docx	Get hash	malicious	EvilProxy, HTMLPhisher	Browse
	https://hkwyolaw.ency.cloud/	Get hash	malicious	HTMLPhisher	Browse
	https://emp.eduyield.com/el?aid=2t26dda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/canoassuplementos.com.br//////dayo/xljj3/bWZlcmVzQHBlby5vbi5jYQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	Unknown	Browse
	https://www.estampariaimagemeacao.com.br/js/images/tvavx.php?7-797967704b5369323074665079536e4f53696c4e536374495330724e4c4d38764c386f734d6741436f367a554c434d6a45304e446f2f4c537a4879396773543031474b396c4e51796651413d-cGllcnBvbnRAdW1jdS5vcmcN&c=E,1,wbWD82FzAB2JeezUv_orUrFt9Y6xAwP1SFd-LxGbn5lFQUR-ICnh2bVD8KxUbI-o1WHs4m_jH3oIrcrCtckuIPjOPE2z7IJMic3gcfP66riD2fyrofyEXyw,&typo=1	Get hash	malicious	HTMLPhisher	Browse
	http://my.manychat.com/	Get hash	malicious	Unknown	Browse
	https://cvccworks-my.sharepoint.com/:o:/g/personal/tbrosseau_cvccworks_edu/Eq-UyPVcAplCp0EtULhG-vgBSBG-0YnvqRHIOFaj8gAVeA?e=0GtZle&c=E,1,DChFGbEapD80-9FdFFEzIgnps7b6noVGZQKGJYQxe5NZ1bO4xoHQSXTZoDZYFQom26YXPkpXr4g-Zcy6HwaX1DHyE-5Bk2WBwo9od82Z27DPdBWYzulyG2zvnA,,&typo=1	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://cx.surveysensum.com/fd3Butxp	Get hash	malicious	Unknown	Browse
	http://idtyvfyfmst.weebly.com	Get hash	malicious	HTMLPhisher	Browse
	http://getquckbulck.top	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
s-part-0032.t-0009.t-msedge.net	https://cvccworks-my.sharepoint.com/:o:/g/personal/tbrosseau_cvccworks_edu/Eq-UyPVcAplCp0EtULhG-vgBSBG-0YnvqRHIOFaj8gAVeA?e=0GtZle&c=E,1,DChFGbEapD80-9FdFFEzIgnps7b6noVGZQKGJYQxe5NZ1bO4xoHQSXTZoDZYFQom26YXPkpXr4g-Zcy6HwaX1DHyE-5Bk2WBwo9od82Z27DPdBWYzulyG2zvnA,,&typo=1	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	Message-ID 08282024 110831 PM.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://control.frilix.com/grace/fxc/aW5mby5jcmVkaXRldXJlbkBicmVkYS5ubA==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://set.page/cdtautomotive/	Get hash	malicious	Unknown	Browse	13.107.246.60
	PO 710467.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Stacey Opted PYMT Tokyo electron limited.docx	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	172.67.74.152
	https://hkwyolaw.ency.cloud/	Get hash	malicious	HTMLPhisher	Browse	172.64.146.38
	https://www.estampariaimagemeacao.com.br/js/images/tvavx.php?7-797967704b5369323074665079536e4f53696c4e536374495330724e4c4d38764c386f734d6741436f367a554c434d6a45304e446f2f4c537a4879396773543031474b396c4e51796651413d-cGllcnBvbnRAdW1jdS5vcmcN&c=E,1,wbWD82FzAB2JeezUv_orUrFt9Y6xAwP1SFd-LxGbn5lFQUR-ICnh2bVD8KxUbI-o1WHs4m_jH3oIrcrCtckuIPjOPE2z7IJMic3gcfP66riD2fyrofyEXyw,&typo=1	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	66cf818156193_ldjfnsfd.exe	Get hash	malicious	LummaC	Browse	172.67.146.35
	http://my.manychat.com/	Get hash	malicious	Unknown	Browse	104.17.214.66
	https://cvccworks-my.sharepoint.com/:o:/g/personal/tbrosseau_cvccworks_edu/Eq-UyPVcAplCp0EtULhG-vgBSBG-0YnvqRHIOFaj8gAVeA?e=0GtZle&c=E,1,DChFGbEapD80-9FdFFEzIgnps7b6noVGZQKGJYQxe5NZ1bO4xoHQSXTZoDZYFQom26YXPkpXr4g-Zcy6HwaX1DHyE-5Bk2WBwo9od82Z27DPdBWYzulyG2zvnA,,&typo=1	Get hash	malicious	HTMLPhisher	Browse	104.21.87.153
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://cx.surveysensum.com/fd3Butxp	Get hash	malicious	Unknown	Browse	104.17.25.14
	SecuriteInfo.com.Win64.DropperX-gen.8867.28776.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Win64.DropperX-gen.8867.28776.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
CLOUDFLARENETUS	Stacey Opted PYMT Tokyo electron limited.docx	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	172.67.74.152
	https://hkwyolaw.ency.cloud/	Get hash	malicious	HTMLPhisher	Browse	172.64.146.38
	https://www.estampariaimagemeacao.com.br/js/images/tvavx.php?7-797967704b5369323074665079536e4f53696c4e536374495330724e4c4d38764c386f734d6741436f367a554c434d6a45304e446f2f4c537a4879396773543031474b396c4e51796651413d-cGllcnBvbnRAdW1jdS5vcmcN&c=E,1,wbWD82FzAB2JeezUv_orUrFt9Y6xAwP1SFd-LxGbn5lFQUR-ICnh2bVD8KxUbI-o1WHs4m_jH3oIrcrCtckuIPjOPE2z7IJMic3gcfP66riD2fyrofyEXyw,&typo=1	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	66cf818156193_ldjfnsfd.exe	Get hash	malicious	LummaC	Browse	172.67.146.35
	http://my.manychat.com/	Get hash	malicious	Unknown	Browse	104.17.214.66
	https://cvccworks-my.sharepoint.com/:o:/g/personal/tbrosseau_cvccworks_edu/Eq-UyPVcAplCp0EtULhG-vgBSBG-0YnvqRHIOFaj8gAVeA?e=0GtZle&c=E,1,DChFGbEapD80-9FdFFEzIgnps7b6noVGZQKGJYQxe5NZ1bO4xoHQSXTZoDZYFQom26YXPkpXr4g-Zcy6HwaX1DHyE-5Bk2WBwo9od82Z27DPdBWYzulyG2zvnA,,&typo=1	Get hash	malicious	HTMLPhisher	Browse	104.21.87.153
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://cx.surveysensum.com/fd3Butxp	Get hash	malicious	Unknown	Browse	104.17.25.14
	SecuriteInfo.com.Win64.DropperX-gen.8867.28776.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Win64.DropperX-gen.8867.28776.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
MICROSOFT-CORP-MSN-AS-BLOCKUS	Stacey Opted PYMT Tokyo electron limited.docx	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	52.109.28.46
	66cf818156193_ldjfnsfd.exe	Get hash	malicious	LummaC	Browse	20.189.173.22
	http://my.manychat.com/	Get hash	malicious	Unknown	Browse	13.107.246.57
	https://cvccworks-my.sharepoint.com/:o:/g/personal/tbrosseau_cvccworks_edu/Eq-UyPVcAplCp0EtULhG-vgBSBG-0YnvqRHIOFaj8gAVeA?e=0GtZle&c=E,1,DChFGbEapD80-9FdFFEzIgnps7b6noVGZQKGJYQxe5NZ1bO4xoHQSXTZoDZYFQom26YXPkpXr4g-Zcy6HwaX1DHyE-5Bk2WBwo9od82Z27DPdBWYzulyG2zvnA,,&typo=1	Get hash	malicious	HTMLPhisher	Browse	51.105.71.136
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	https://outbound.knectit.co.uk/u/click?_t=bnBkL3ZkcGpzYnVvcHV0c2pnQW9icGUvenNzYmMwd2ZlL3RzZmxzcHgvNjYxNHNmb3NmeHQvZm9qbmJnM29wbzAwO3RxdXVp	Get hash	malicious	Unknown	Browse	20.119.0.39
	file.exe	Get hash	malicious	Unknown	Browse	20.75.60.91
	http://www.water-filter.com	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.253.42
EDGECASTUS	https://cvccworks-my.sharepoint.com/:o:/g/personal/tbrosseau_cvccworks_edu/Eq-UyPVcAplCp0EtULhG-vgBSBG-0YnvqRHIOFaj8gAVeA?e=0GtZle&c=E,1,DChFGbEapD80-9FdFFEzIgnps7b6noVGZQKGJYQxe5NZ1bO4xoHQSXTZoDZYFQom26YXPkpXr4g-Zcy6HwaX1DHyE-5Bk2WBwo9od82Z27DPdBWYzulyG2zvnA,,&typo=1	Get hash	malicious	HTMLPhisher	Browse	152.199.19.160
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://alkimialofts.com/on%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	HTMLPhisher	Browse	192.229.133.221
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://control.frilix.com/grace/fxc/aW5mby5jcmVkaXRldXJlbkBicmVkYS5ubA==	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://sesh-gangrene.shop/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://bio.to/vCOt6d	Get hash	malicious	HTMLPhisher	Browse	93.184.221.165
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://tinyurl.com/NDCEurope	Get hash	malicious	Unknown	Browse	93.184.221.165
	SecuriteInfo.com.Program.RemoteAdminNET.1.15125.10364.msi	Get hash	malicious	AteraAgent	Browse	152.199.23.209

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://hkwyolaw.ency.cloud/	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
	https://emp.eduyield.com/el?aid=2t26dda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/canoassuplementos.com.br//////dayo/xljj3/bWZlcmVzQHBlby5vbi5jYQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://www.estampariaimagemeacao.com.br/js/images/tvavx.php?7-797967704b5369323074665079536e4f53696c4e536374495330724e4c4d38764c386f734d6741436f367a554c434d6a45304e446f2f4c537a4879396773543031474b396c4e51796651413d-cGllcnBvbnRAdW1jdS5vcmcN&c=E,1,wbWD82FzAB2JeezUv_orUrFt9Y6xAwP1SFd-LxGbn5lFQUR-ICnh2bVD8KxUbI-o1WHs4m_jH3oIrcrCtckuIPjOPE2z7IJMic3gcfP66riD2fyrofyEXyw,&typo=1	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
	http://my.manychat.com/	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://idtyvfyfmst.weebly.com	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://passtcnet.homeunix.com/amj/2.mp4	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://sgsconsulting.com/	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4229
Entropy (8bit):	5.456182843640352
Encrypted:	false
SSDEEP:	96:0q8NkGS1fQZp+PgR58rh/cI9URoDotovQBwVDvPOVszJkKcxoRI4a:/8NBSSp+PheoDULMSsFkKLk
MD5:	C70551401A373B48ACCF1343CD5C08DA
SHA1:	E599500B295E381E6A6EE438D4896B0EBBE9CC84
SHA-256:	37282E440ADAA1AF2BEE79A13BA636DDE732C545C57885F55A95F7DE296C232D
SHA-512:	BD9DE7D1DFACA7DCFF89A342CB1321FFFA955E7E2348EE9346528EBA04AE6FE7451F4B56E7D900ED6553B4C0FDB660217577386B909098E5A41ABC5296259653
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRi

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2ea25989-3069-4732-998f-28166adf5e8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70870
Entropy (8bit):	6.072761597797785
Encrypted:	false
SSDEEP:	1536:BMGQ5XMBG2h0y7rmzQ3qod9HshCXg67AKi5jdK1N9KEDzIOliK:BMrJM8837rIRodihCB7AKi5jdK1NoEDJ
MD5:	325750DF50717A459D5B9E243A1165DE
SHA1:	5173B7611FA9643220E92C9994DFCF6E283098CA
SHA-256:	E6038339DCCA02C0A1C20CF817C83F4D6E700D4112FA15FDCBA654693949C253
SHA-512:	5CC9EA5C1B383661AC28C4F94D6685B4046654A4EE07745C023F589BF46B4532D76914958F421FDAFB816AE5C0929550C0B6C156B212F01FF447D7DEC335052E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433237694284","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\32178d96-5683-4e46-9ca2-dcbad3c044da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2956
Entropy (8bit):	5.580702500407227
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afQx/p+xZBiRlkHB+/drx3DvBZOtoRtXaJkX6cGBFwgMU444C:Xq8NkC1fQZp+PgREBwVDvPOStqJkKc5G
MD5:	7BE15F808C80CCCF87C45ABACE33C7A7
SHA1:	302F5021ACED3BACA8671733827CF377E619459D
SHA-256:	F1B05EEC9EBB7821E3EC0A5FBAB4D4D3A3965B838B2D9DAB9DE695D9A9FF1EC2
SHA-512:	5D8C810A66C174CDC4F782F1A011F4BD4456654035FDF5A1B2D1B132BA53E55905A3F2213E500414DD080E65EADE32FB395B227FC6A14D0D2128A297DEC3BF14
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"policy":{"last_statistics_update":"13369433235359103"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3f1e711e-ee30-4ff0-91bb-81bf9057fe03.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70909
Entropy (8bit):	6.072831724900535
Encrypted:	false
SSDEEP:	1536:BMGQ5XMBGbh0y7rmzQ3qod9HshCXg67AKi5jdK1N9KEDzIOliK:BMrJM8F37rIRodihCB7AKi5jdK1NoEDJ
MD5:	104F89B43F03F3DF7DA7E6C170D6F8A0
SHA1:	060C7802B12F6D023F143CF040E72D97D6C5C030
SHA-256:	156DB7AB1309A33C9A73BC23BF3997B666C891F76966447EC1F8876E0B2778E0
SHA-512:	5AA31BFBE5341CD6FDDAAC1D5C49D61CBED9EB794A4945D6AB4A73DC965E3F83A2A5102F8A64D983B340033C701791A230E98513A1E3870A75021A43EE9C0199
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433237694284","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5655f4e1-77a2-46df-a99a-d00bcb364af7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20988
Entropy (8bit):	6.062132877277109
Encrypted:	false
SSDEEP:	384:rtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSZCSxdWWKb+Mh0lkdHd5q6q:BMGQ7FCYXGIgtDAWtJ4nYydWWKfh02t4
MD5:	F215FD8A088C49BF3C1A916EFF4DB9EE
SHA1:	7FD4A7A9718A3F30DD6FD0F4DC3F830DE4CDD436
SHA-256:	91C6289A1733CE5AB188D6C27E92A537253049F152ABD09845CFA7348FA27273
SHA-512:	5BE318A79EBC09BCF88110FB008D06DE176C5894F52A4AB056790EE9A0482BB45CA737C90383C79B42495504E3C1D7DD9248349492BAA79C67E04E481DC98A84
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433237694284","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5a9f00a4-4714-49eb-88c6-662734bbaf38.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20988
Entropy (8bit):	6.062137112624993
Encrypted:	false
SSDEEP:	384:rtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSZC7xdWWKb+Mh0lkdHd5q6q:BMGQ7FCYXGIgtDAWtJ4nYddWWKfh02t4
MD5:	B48AE60F8575F88F8384B06C143DB168
SHA1:	F78AD12EA23319ADBB71A79F0ACD3D74089E6E56
SHA-256:	BA8A820AAAC6D9402566AB5D91E29E9737EE7897D407A6304F8E570FD59F92AF
SHA-512:	29E2E5090B9BC32A9C16D3137FFC00807214C1B6C556D98E4D876AC152BC8FA4ECBFC8E558500AC322D063D270C55671BB7FA58008A712C2F1CB875E25508600
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433237694284","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\71add3dd-bb72-4124-bde8-935b86ba9009.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7a6434c7-f1c4-4d05-a607-718eb2903649.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24328
Entropy (8bit):	6.054604789955538
Encrypted:	false
SSDEEP:	384:rtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NGZC7xdp8qdpVEDzA9FOl1+Mh0lkdHd5o:BMGQ7FCYXGIgtDAWtJ4n2ddpiDzA9FOk
MD5:	D4EC2B27843A9D566BD1BAAC7AF0DE3D
SHA1:	42AC8825C89E537F8EFC86AC801F64CB44129202
SHA-256:	484E6466C520A5330D6A7114B2018BFB43BDAA0C381F8F6949D5134F7DFD6C13
SHA-512:	A023F04B175492B41B2232A5ED82C83D5A9E622A53CEB05326D3336CBDA13719EBA027BF0C9DCC94E4FCDAFFEB00606230CE2B2B8A474DA46A67D0F393797C36
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433237694284","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\96490169-4e4c-4809-a89a-b3ca12d2bb2d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D0CB93-14E0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4571777001688161
Encrypted:	false
SSDEEP:	3072:ecIBGWo2fKLMxpoh7/HxTLaToDcfITb0/inhKg1HFfFBjBcPsBEhZvqE0cAwfShi:/WwzdnhKaHV4aCM0TaHIKKNM
MD5:	3811877C36306CE03D7A12E64B1D9311
SHA1:	2F605848C240088E15D6F37AD28F39CF1E075111
SHA-256:	07AE20A380FE753F31FC07E97B363659F9A39CD24CE89B542175DB452B956ACF
SHA-512:	770DB323521C9930B8A356EC93EF3A48C85D36449C7A4E09B97B56521433B7DD2287C344BDD01AE64D446F8E0121AA42C4955DE14CC97F82A5E4395BABBF3FC5
Malicious:	false
Preview:	...@..@...@.....C.].....@...............hZ...Y..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".taxdgp20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D0CB93-258.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04048930067935933
Encrypted:	false
SSDEEP:	192:DDxUjLYiVWK+ggCdlcJtD+FX9X5dokgV8vYhafvNEfb8GRQMp/Rn8y08Tcm2RGOD:HxUjjlAqHenhIud9/R08T2RGOD
MD5:	E722749B498AFF397C95FAE94AAB8E66
SHA1:	EFBC69EC876033BFA4F4A50373C501A9DDBFE890
SHA-256:	D273FE145B5813BD71BAD99DB164A16859D549573D5FA656C2497ED610BCFFF1
SHA-512:	EB04516E484D29909998DDA1126A19DD0CCC702167AB2D726E8094CEAF7002C6DE2C56949EE4FD952FB1C6B085FB0CA0FCE27DD611CE3187114E7C2F8A943605
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".taxdgp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............A.....................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...-...J@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z........................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1745421022356455
Encrypted:	false
SSDEEP:	3:FiWWltl9SaK6HvAViHSRqOFhJXI2EyBl+BVP/Sh/JzvddSYNsvIoqTsXstl:o1gamViyRqsx+BVsJDfQvIovXsX
MD5:	0BC3EB12714510191CFAB3895A918082
SHA1:	068595079EB3C12D5EE419E58DD9C411D24EAE9D
SHA-256:	F0122246CB71526FEE93C98EE6CD91D4A8357BE9C5F2FDFD0CFD7E08B53D8AED
SHA-512:	48955076E74AD20CA0E8919C47AD5A1917FB7A8983381EB73D4404D1D605E2D724B350D1939F09B787E6839450A60155737DFEAB9917C1E4A19E3FFD764C3ABC
Malicious:	false
Preview:	sdPC....................?......@.O&.I..."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................e387e06e-0e8e-4ac7-b1dc-928b5665d956............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3d05671d-b3d1-4f07-a841-a136dca3f7c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.9833162532928155
Encrypted:	false
SSDEEP:	96:st4qfais18b9mcSN8zsAks85eh6Cb7/x+6MhmuecmAebAFOQP+2Mi/EJ:st4MsySNksAks88bV+FiAB+PiMJ
MD5:	21E92F21C52B70A79A6ED2C99E385125
SHA1:	2C214CE17D2F096D636E9E2089D2B73EA7995B7C
SHA-256:	7FB5FAECBF3CA88921D920A391FFDECBF0CF6FA029C10E69A17FA709CAEE31FB
SHA-512:	2925B4F8004E12F0B475C870C57A2B4736E35FDD42C3824E8164E18D0E7C5B7468B290C59FEB080E2E68143E7F3C63B633B292EFB1020F5EA4EDAFCEE59979D7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369433236325939","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369433237641960"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\4517fe76-5cf1-4c8f-89bc-1434729b91a0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.565424250194648
Encrypted:	false
SSDEEP:	768:POl5fkWPwWfN58F1+UoAYDCx9Tuqh0VfUC9xbog/OV5UXkkrw/gpGtup:POl5fkWPwWfN5u1ja8Ek9/5ta
MD5:	6E113359B55C7917A5AF80E7E64669A8
SHA1:	D7E6BBE1F73261352476D3DC6625897D28690E41
SHA-256:	6B1A41C9FF1337AF8ACE9C1E93352BC5A6227913EAA33A683500BF8AF74E5499
SHA-512:	AF6519D511A392199C4DE21FDD91209EE1A4C042ABD523E07E2483FF5B040C45D1D9C53645C3D7D8529711240F8E07B596417965555A9B5F6C3CE87FFE72CA00
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369433235913593","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369433235913593","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7c516d4d-40f3-4995-a11a-4564e468d263.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565767948706676
Encrypted:	false
SSDEEP:	768:POl5fkWPwWfC58F1+UoAYDCx9Tuqh0VfUC9xbog/OV5UXkkrw/ypGtu/:POl5fkWPwWfC5u1ja8Ek9//tU
MD5:	5F228E18DDEE970CE092AD0D16F05B1A
SHA1:	AA28D1244C28C2F6ED1B18DBCE0089D7B16733AD
SHA-256:	56B0A573238E2010A7F438D19F3307A83E28534AF33457ED75D02C5ECC30A656
SHA-512:	D7CAF5EA44CF9E53DA891AC22B8CD4BBA47B5EC942609AAEC296C731C0945046CC7960A8D3EA6C0512D7D851335B2228025EAEA862095422D2C04B9DD507381A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369433235913593","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369433235913593","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\9ac01060-df76-4ecc-948c-efe5ecdc0007.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.98096894336983
Encrypted:	false
SSDEEP:	96:st4qfais18b9mcSN8zsAks85eh6Cb7/x+6MhmuecmAebSFlQP+2Mi/EJ:st4MsySNksAks88bV+FiAi+PiMJ
MD5:	C29102D08ACA15C2116667521F65540E
SHA1:	914A19D822C1EB94D0D07F08CB250B76A0F7A8E2
SHA-256:	69350944353794853F381965015A4304C261513BEEF7F71F7377D71DE3C987A8
SHA-512:	EF28C97944B70118ADABCA656BA1AF43C5D9111454BBE6FF0B10773CEC93B5BE42AA3A1C94EF4FDE4B63838A0EC73E9B68D3BCB2D87571E04B68194E561AA928
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369433236325939","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369433237641960"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321053641968649
Encrypted:	false
SSDEEP:	192:kAjAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:yOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	C11C9024C34D5F756A2507C4E6D8837A
SHA1:	44D9A72AF7C886FD0244A3F614C195D11E0F824F
SHA-256:	7C5F2C5A138794DC6891964F82B0B1845955C0BBD25C3C2D97B8C1CD7AA296FA
SHA-512:	E85910473B4F823EF98F33AA824D912C5C1CDD2141B24C3202C6D2BC479E9B129D7EF9D26D5087B3E09F7902FE021BB257D5E13DB0E6D497C3E7F646C2B75CB2
Malicious:	false
Preview:	...m.................DB_VERSION.1.\...................QUERY_TIMESTAMP:arbitration_priority_list4...13369433241609391.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.129621127916156
Encrypted:	false
SSDEEP:	6:N5p81wkn23oH+TcwtOEh1ZB2KLlL5xpM+q2Pwkn23oH+TcwtOEh1tIFUv:NnbfYebOEh1ZFL1jpM+vYfYebOEh16F2
MD5:	8D64F49DDC578652B43B0E3C252E1CBE
SHA1:	20BE381F2DB3275CAE00B2DFDAC6299C3E55C125
SHA-256:	EE9DFD622984F3F1E5176FE5D6B9BA1759940B5CAF2E290109E8F3993055B644
SHA-512:	F270ADA9FB84FADC61F4A3319735E5A6541E3F6B8D703D24F971D1812A452EA4E13AA8F8D0457E4595893D342E533D27A5006A69C89E343A19A12106FA0E4F49
Malicious:	false
Preview:	2024/08/29-15:27:20.790 218c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/29-15:27:20.925 218c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04412515129189289
Encrypted:	false
SSDEEP:	6:/Fii25KManKkkM/lad4GKxgZ4bdMtiR0+kllRgOH/l0a:drMdtEa9G5dEiR0z/P
MD5:	0ECD78DB8CDFFE52D74553D7C06EE6D5
SHA1:	552347449B950788415D53C7B0C4EF04D004A17C
SHA-256:	74E450D73CE4A28A282A0282B849E2C7E40F7078D946DC2BC7446685DB4B0222
SHA-512:	58335BFB2DE5E3B4D010E95C9FB2A61317737CA371250BCA93CCFCD97305A04363B3D00880A500C785E74B58473B1BB5068619531873E2DC75A067D1002E57B1
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09547921408782636
Encrypted:	false
SSDEEP:	24:drOV4XeaPVHk+/nV4XQ3eaPVHaHVIRBNUeGCUAPnQzLIoMw+ApQzjlZEYT38EWp5:sV4XeslfV4A3es3NUeGTAW8JT3lWp4
MD5:	059A9BE58DB933A32C522FB33C24E147
SHA1:	941430BDE65D9BE545206CDB27EB2FAF6E388C91
SHA-256:	F422F685619D5534CC33152B8AEAF990150E8250358D7EC504F97022E30EB24F
SHA-512:	41BA1323DC266ED0D3A1FC761732CDC3AF0A45B71D933864CCBC85884B2FE965F8513ADE95F19E819E32FB4ED7B09E6B9FFF90AB15E367DA9712C5F33C3236C2
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2833639558646497
Encrypted:	false
SSDEEP:	384:NDZNqyJtMG5DZNqyJtM3QuRJtbzQQuRJtbw+kfZ/JtLL:NDZVJtX5DZVJtoQuRJtYQuRJtDkJJt
MD5:	81EECC2A473C7A43E586D9EEB591EF8B
SHA1:	DB80C36B3ADA07A56414CD93D5ED01871E993C6E
SHA-256:	7C7FD48C3D8F6529B6A65F4DA009F676141743ECD832E013FBCCC73BBB26222D
SHA-512:	EBC92C285A29CBF4407F23FDAD22DAE799DC95D49382962113720A966B670AA10FFB8261E00DBE9474AC8A3DC56A7B8E5A79C6F70DEA35FFADC2CD27F9E8BDE3
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsuln7a:LsB
MD5:	C42B179F6C595D0542EAF924D2340776
SHA1:	C1105A0609878E5A726549E55BB93DD586FC24D8
SHA-256:	91B5D67FADE46811987557956B353FC773EEACB4EF240AAD560E393E68667440
SHA-512:	631E581C01E1AE3F1F84EB6A0D3BF3C1FB850AED4E5680E94F9250B60ABC5539360DC46268B445FEA603A36DD39FD3BBE605CE7FAC8E7FEF05712AC3ED99519E
Malicious:	false
Preview:	........................................."..m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ldDaENFIBl:JNEl
MD5:	836FBC95EBAD452239C1E8094890230A
SHA1:	676D44180BE563E9A6F2657D5C3A78A89DEAB59F
SHA-256:	4C87A3FB9D5CD37716ADDC7ABF73440BCA7612C71BE280754118A17FDAC5CC1B
SHA-512:	FE81EBEE7E0D05F05997A6A74648DE785D71B86CDAC6AE418C3DE83375535FBB7006DE955449ED01E1170AB4667049A197F5CF2727CDAC02EEAFF53E42D318B9
Malicious:	false
Preview:	(...8...oy retne.........................-.m./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ldDaENFIBl:JNEl
MD5:	836FBC95EBAD452239C1E8094890230A
SHA1:	676D44180BE563E9A6F2657D5C3A78A89DEAB59F
SHA-256:	4C87A3FB9D5CD37716ADDC7ABF73440BCA7612C71BE280754118A17FDAC5CC1B
SHA-512:	FE81EBEE7E0D05F05997A6A74648DE785D71B86CDAC6AE418C3DE83375535FBB7006DE955449ED01E1170AB4667049A197F5CF2727CDAC02EEAFF53E42D318B9
Malicious:	false
Preview:	(...8...oy retne.........................-.m./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ruEDHKn:tDqn
MD5:	7C4C1712624C895B96D77DD8A5AA79F3
SHA1:	15A1F861D940BE708E90B188B5CDB3B24CC17073
SHA-256:	A7FB2E2EBB6530AC10506F3F23E4216B3A3C92B67FF84397719351ADE2986B62
SHA-512:	BEDBE9E457B29038662470AF30299950EDD5D0A77199F8B3D1A59F1D79240E2E5F1603A11E824715241019168084EE903C7C47DCE5D67838EDFF551CBB49FAAD
Malicious:	false
Preview:	(...._l.oy retne...........................m./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ruEDHKn:tDqn
MD5:	7C4C1712624C895B96D77DD8A5AA79F3
SHA1:	15A1F861D940BE708E90B188B5CDB3B24CC17073
SHA-256:	A7FB2E2EBB6530AC10506F3F23E4216B3A3C92B67FF84397719351ADE2986B62
SHA-512:	BEDBE9E457B29038662470AF30299950EDD5D0A77199F8B3D1A59F1D79240E2E5F1603A11E824715241019168084EE903C7C47DCE5D67838EDFF551CBB49FAAD
Malicious:	false
Preview:	(...._l.oy retne...........................m./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlBQK/:Ls36a
MD5:	DDCC01D19ABF8ED674AA60899021511B
SHA1:	50E9382992AD2410B6E717F10B8B7C214F302B0E
SHA-256:	890B8D1110C9D0152771C137215DF2C665BB6E611B8D530E2E3CA91C12019EC6
SHA-512:	9CFCD0472C5910A5CF46B5902927C27FB007B8307C9719C08BCED1B82B5471C585E967180B4A893BE3023D6D22CAC2860AFB2B269B2C43BA2F3A09D4F4F9ACD0
Malicious:	false
Preview:	........................................\...m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354104623765459
Encrypted:	false
SSDEEP:	6144:wA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:wFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	9F26500C0811828A4DA681F1320B630D
SHA1:	FA6C008667908EF5C3C37424582218D239C1D919
SHA-256:	DB3B56A88FD68150D4B0097DFD055769753260D36F1B6B1034C25F8EF2195BC1
SHA-512:	7ABEAC1FC54B6EC9F5406E2C722F306F80E799732BCF078F256BD9351CF1B9439104896B53178A29A7E85411B8A291CA8D3D2AE6C79D0C9F2F65B58E7D6FC820
Malicious:	false
Preview:	...m.................DB_VERSION.1..P7q...............&QUERY_TIMESTAMP:domains_config_gz2...13369433241027624..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2108526888899505
Encrypted:	false
SSDEEP:	6:N5ik1wkn23oH+Tcwtj2WwnvB2KLlL5u3+q2Pwkn23oH+Tcwtj2WwnvIFUv:NCfYebjxwnvFL10OvYfYebjxwnQFUv
MD5:	25590DFC238DC8C953893ADE933392B4
SHA1:	D2469BE53F068FAFAC6100E336840AEDEA92E31F
SHA-256:	706554A850DA75B7182F73A28B32071EB3FF1FC82ADDCE23F8688395BCC290B2
SHA-512:	5D9C830240FB17775A57A1E62361F1E3724C421F91DEC428EF0C0B14FC53144FD0421B3C50377EF49E81A1A43D2EDA6D7C016369A5BEC02CF506DC90C7B6BA5F
Malicious:	false
Preview:	2024/08/29-15:27:20.840 21b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/29-15:27:20.919 21b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324606665523056
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rn:C1gAg1zfvf
MD5:	352611B0300139E0ED66FC7234499C84
SHA1:	725554358CF7BB05DF857A4D618375B1AF4DD81B
SHA-256:	598B24ACE8224954AF0A07DC0262C1F10D103962A0A18638D73926D158253CB0
SHA-512:	CDCB7585CDFF8C75F39D29E72F0EA1FE2910D7F24E3DE7E7D0BC99EC17FCEA527563F7DC2505B6C822B927C23FD0BD5279278CF2399497E36B56B0BD86F6F620
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.220533775889718
Encrypted:	false
SSDEEP:	6:N5lIa3M1wkn23oH+TcwttaVdg2KLlL5xlyq2Pwkn23oH+TcwttaPrqIFUv:NrISrfYebDL1DlyvYfYeb83FUv
MD5:	F63D4103F2C98E56703F46936A7A90E8
SHA1:	FEFC9A40ECB765828AF699ABC61936E37D48C350
SHA-256:	9A6A1DEF47B8FA82F3570D7C83EF0D2FEEB82A50B68FCBC338F2946935389476
SHA-512:	5520BE9FD15CFBED0B10DF445DFA0CBD86C6CE114996F9C26EAD6AADAD213273D57871622459E6D24F0D4E9B373090263DEB972D96FF640AA608298D3E307147
Malicious:	false
Preview:	2024/08/29-15:27:15.919 1cc4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/29-15:27:16.177 1cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.205790656848523
Encrypted:	false
SSDEEP:	6:N5Bc3M1wkn23oH+Tcwtt6FB2KLlL5Z+yq2Pwkn23oH+Tcwtt65IFUv:N8rfYeb8FFL1iyvYfYeb8WFUv
MD5:	BDB69C879DCAFB17EF3980D443EB308C
SHA1:	BA786A53649C4AF0EBE99DEC3970A7CFEFACD4CA
SHA-256:	C074D37BE0091269C27AADBD93C3843EC55B100A9A28C8D15C553A280EB96840
SHA-512:	8AA47F2A5035823B0CE1932D3C80B18E9FF6132E96ADC2844CF8CBF2463018CB4BA84D9263882D830AF8E6335EFB1A63DB805945528505D48EE249959C370EB2
Malicious:	false
Preview:	2024/08/29-15:27:16.179 1cc4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/29-15:27:16.194 1cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.201209690816
Encrypted:	false
SSDEEP:	6:N5y/81wkn23oH+TcwttYg2KLlL57L+q2Pwkn23oH+TcwttNIFUv:NQ/bfYebJL1BL+vYfYeb0FUv
MD5:	B28EB5E7DA6CC6DC2CECC349153D320E
SHA1:	BC27A4A934A48E1777F12A240B508366C9EC4832
SHA-256:	AC8748558009CE4C63FBDA6C1E2E641C4137C58A5ECA92B364978ADF3C2EB3E6
SHA-512:	EA17519630F6A956C5FD02B1FC508718213EE6B7BBB59B0EFAFF03178E78A47FE2D479825BFC3F1A2FF60867FF65A3EE8C37DEF5A0D2C6B60B7643C6A4CFF3BE
Malicious:	false
Preview:	2024/08/29-15:27:17.843 1c7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/29-15:27:17.854 1c7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlqbIB:Ls3qbI
MD5:	0530E9A7FDCCAA76CB54EEB95DD1AB9E
SHA1:	ABB83FC2378C4C956606283157D018C87AC25782
SHA-256:	1FFE486A088AC69661DF77699C870D93D18DC41BEA6D7F49E54B154BEEB4104E
SHA-512:	27B759CAE265659B19784CB4A8AA473699E1BB8E636FC903E0E5FF920F57264C05C49120ECA1789A5D6D56A2E4DBCAE4E6BAB351428E83823F8BAF089137DC56
Malicious:	false
Preview:	............................................m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2182285738090153
Encrypted:	false
SSDEEP:	3:itjtFlljq7A/mhWJFuQ3yy7IOWUCl4dweytllrE9SFcTp4AGbNCV9RUI5:l75fOMud0Xi99pEY/
MD5:	3AD8EDCC101B3508FBD83ADE2C3E7E56
SHA1:	106C0FA5B3B09F68B49E1937691BAD95B4300418
SHA-256:	D858CAF7D18F1329E3B3DAD7C8D1F1CE0D53A62CBF31096237EE0E5759B4E431
SHA-512:	5E640160D372C4BC578E1D2D86B8124DBA210FC47E725EA74430DD715715436FB469D89EA4F6DCF33E1F3FA50B71699FF2BE5607102873ED25740E69FA1BC396
Malicious:	false
Preview:	............E.<_...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.2348882713714415
Encrypted:	false
SSDEEP:	6:N5w+Sb1wkn23oH+TcwtRage8Y55HEZzXELIx2KLlL5wM6vIq2Pwkn23oH+TcwtRz:Na+VfYebRrcHEZrEkVL1aM6AvYfYebRz
MD5:	695AC88FB487CCD8D4D2ED190F5781EE
SHA1:	4E107919E699F50C4DD8A659FD8E773F373DE732
SHA-256:	67435AA123F2A7170591D43EE6CEA143ED1B47418D00BE7370AD305F915960DF
SHA-512:	24189B3E6D2479B5D2F7225E777A9DCB0A4BE2A3C7A438B19CE0625744C07075A6B83CE45E5DFB5B0B0560AFB40DDF3C400B2875C3B19F09E3F7218F14D1B306
Malicious:	false
Preview:	2024/08/29-15:27:18.778 1c70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/29-15:27:18.790 1c70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.260588569256688
Encrypted:	false
SSDEEP:	6:N5O1wkn23oH+TcwtRa2jM8B2KLlL5Q+q2Pwkn23oH+TcwtRa2jMGIFUv:NLfYebRjFL1m+vYfYebREFUv
MD5:	0076438408D1647B7EE7736CFD9D0F93
SHA1:	210CECBB4D657CEC2E66864E582673C0220079AE
SHA-256:	0F0FD11CB100AD519145A15FC5907EFCE211FEEBF99A39F96314BB8D7DA7CB25
SHA-512:	E5192052419DB3507917F038F25ABCB95708FDB6F35B522F1F5436568A78B3195D7FF0AB74A38C60A9D7C328C6000CB4884CBEE054D2B50F98D17E339786A786
Malicious:	false
Preview:	2024/08/29-15:27:16.493 1d7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/29-15:27:16.518 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\0420c394-d469-488a-8833-4795479491c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\04d5979f-054f-4cc5-b3f7-459d9f06b0c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\0d5260b2-38ab-44b5-9f3f-f797b3e47a01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3f398.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7608695782051433
Encrypted:	false
SSDEEP:	48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBk66:eIEumQv8m1ccnvS64
MD5:	B2D8970F3EC6F0090FB155359146E961
SHA1:	D41FA0E360771647A5FBA06B1BE6692F72D424EA
SHA-256:	613B1C71DD80286A120D9D9791800EA828989CFA779F81C2C44806C7FCD4AC2F
SHA-512:	34396F26CA654A7224F1EDD3435CB32DF54A76CA64D15ECFA7337384FE522EF326DFA6A61C0CF0E9008091032C4499129316C0201A4A54F7F8B4304C5EEDA289
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF2d353.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\a0cf5f7c-093e-4da2-b86d-26a15f61ab69.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\c18d4190-8990-4223-8d3f-317c711e0ca8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.973103975498021
Encrypted:	false
SSDEEP:	96:st4qfais18b9mcSN8zsAks85eh6Cb7/x+6MhmuecmAebw1+2Mi/EJ:st4MsySNksAks88bV+FiAV+PiMJ
MD5:	3073A4CA0C76D20A75AEE7DF68BE5124
SHA1:	B4C44D2415B45582C62ECA7161204FB576A6BF02
SHA-256:	3595BE9A5BF128231F14C9D75301F24AA3B150779299B941A55E971A366BD99D
SHA-512:	06B8D65F0CEB2D787DBAF7F245D8EE2793B4A02FF66F551AA6370A0E2995FA3C3F22CF514E9D2F86545E8BCD57468B2D531EE22F13DF083319A03A0A0D5FFB37
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369433236325939","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369433237641960"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3634f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.973103975498021
Encrypted:	false
SSDEEP:	96:st4qfais18b9mcSN8zsAks85eh6Cb7/x+6MhmuecmAebw1+2Mi/EJ:st4MsySNksAks88bV+FiAV+PiMJ
MD5:	3073A4CA0C76D20A75AEE7DF68BE5124
SHA1:	B4C44D2415B45582C62ECA7161204FB576A6BF02
SHA-256:	3595BE9A5BF128231F14C9D75301F24AA3B150779299B941A55E971A366BD99D
SHA-512:	06B8D65F0CEB2D787DBAF7F245D8EE2793B4A02FF66F551AA6370A0E2995FA3C3F22CF514E9D2F86545E8BCD57468B2D531EE22F13DF083319A03A0A0D5FFB37
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369433236325939","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369433237641960"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3d87f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.973103975498021
Encrypted:	false
SSDEEP:	96:st4qfais18b9mcSN8zsAks85eh6Cb7/x+6MhmuecmAebw1+2Mi/EJ:st4MsySNksAks88bV+FiAV+PiMJ
MD5:	3073A4CA0C76D20A75AEE7DF68BE5124
SHA1:	B4C44D2415B45582C62ECA7161204FB576A6BF02
SHA-256:	3595BE9A5BF128231F14C9D75301F24AA3B150779299B941A55E971A366BD99D
SHA-512:	06B8D65F0CEB2D787DBAF7F245D8EE2793B4A02FF66F551AA6370A0E2995FA3C3F22CF514E9D2F86545E8BCD57468B2D531EE22F13DF083319A03A0A0D5FFB37
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369433236325939","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369433237641960"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565767948706676
Encrypted:	false
SSDEEP:	768:POl5fkWPwWfC58F1+UoAYDCx9Tuqh0VfUC9xbog/OV5UXkkrw/ypGtu/:POl5fkWPwWfC5u1ja8Ek9//tU
MD5:	5F228E18DDEE970CE092AD0D16F05B1A
SHA1:	AA28D1244C28C2F6ED1B18DBCE0089D7B16733AD
SHA-256:	56B0A573238E2010A7F438D19F3307A83E28534AF33457ED75D02C5ECC30A656
SHA-512:	D7CAF5EA44CF9E53DA891AC22B8CD4BBA47B5EC942609AAEC296C731C0945046CC7960A8D3EA6C0512D7D851335B2228025EAEA862095422D2C04B9DD507381A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369433235913593","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369433235913593","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF33375.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565767948706676
Encrypted:	false
SSDEEP:	768:POl5fkWPwWfC58F1+UoAYDCx9Tuqh0VfUC9xbog/OV5UXkkrw/ypGtu/:POl5fkWPwWfC5u1ja8Ek9//tU
MD5:	5F228E18DDEE970CE092AD0D16F05B1A
SHA1:	AA28D1244C28C2F6ED1B18DBCE0089D7B16733AD
SHA-256:	56B0A573238E2010A7F438D19F3307A83E28534AF33457ED75D02C5ECC30A656
SHA-512:	D7CAF5EA44CF9E53DA891AC22B8CD4BBA47B5EC942609AAEC296C731C0945046CC7960A8D3EA6C0512D7D851335B2228025EAEA862095422D2C04B9DD507381A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369433235913593","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369433235913593","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.210914673781785
Encrypted:	false
SSDEEP:	6:N5WFYPD1wkn23oH+TcwtSQM72KLlL5U/SN+q2Pwkn23oH+TcwtSQMxIFUv:NbyfYeb0L1Ui+vYfYebrFUv
MD5:	D1C187F9FEF586377FA1A08EC64664EB
SHA1:	E85F66A97B6179098B96574A56ECCB73E5C73265
SHA-256:	FC27DC325A63CDC2FC5D836BBAB3AA219BB63B51EB9B2D4FEFF2E60DAD255A95
SHA-512:	9DB37ED091C312BE340178FDFD1F07A9B584FE577C7AC4217A9B3C199D87DDD61DC2421B6A2418D89BC47A8A7075A57A320D52B59182E5D585323F87992D8B11
Malicious:	false
Preview:	2024/08/29-15:27:33.660 1d7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/29-15:27:33.745 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.134141726199295
Encrypted:	false
SSDEEP:	6:N5ZHuM1wkn23oH+TcwtgUh2gr52KLlL5+oq2Pwkn23oH+TcwtgUh2ghZIFUv:NqrfYeb3hHJL1BvYfYeb3hHh2FUv
MD5:	A5285CDAEB3DFDA3875B5CD5BE08A560
SHA1:	7B971731D9B97CA6D44F45070B746E80EA9BDEF5
SHA-256:	399DE64029E8F778B0EF1211F943A018A8B684CC1F951A3FD765E1DA34094939
SHA-512:	360CD73C3604D84BA60B976E99814FF2C3005978D4510A3F9C2FC267A2BB0C0C44CF62D9E2938132244E533C099541D42C17593752F5E424DF6CA0F360A42F13
Malicious:	false
Preview:	2024/08/29-15:27:15.886 1ca4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/29-15:27:15.908 1ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:LsulQDa:Ls3D
MD5:	679294BABD9F83A978113C0575D41A82
SHA1:	42477706C72D3EF77D76678A4E8BE4B0BD18EBD5
SHA-256:	3B87F0A4A311882CCCE857E21667B4690A72961296839970F37BF81DE72E559E
SHA-512:	0EA1F47EEEA1BCC095EB32A937343A01E228582F627D167AEAC13CC10F1A47A7332BA8B9193AA33D3A94556941B014B06C499BD88D6D152EC2A9967D0F06965E
Malicious:	false
Preview:	........................................(.@.m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:vQ8i0E/+Ll:I8K/+Ll
MD5:	404705167B60D02FDC2C5EBB92F9D4DB
SHA1:	493233804A86E4E679681D1A4841ECA6AA106A38
SHA-256:	C7A7DDA31B545EF44537673A561B96DEEA494D0BD3BA5A46938FFF465935D505
SHA-512:	7385101C035B99DC53393D5E037A052F185D98D8D0608F1D206B2B397C6AAE232DAEEB53C3FF485ECE0BEEA0622E5689F2B92D91402526EB67CC945B860F63E9
Malicious:	false
Preview:	(....5..oy retne........................c...m./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:vQ8i0E/+Ll:I8K/+Ll
MD5:	404705167B60D02FDC2C5EBB92F9D4DB
SHA1:	493233804A86E4E679681D1A4841ECA6AA106A38
SHA-256:	C7A7DDA31B545EF44537673A561B96DEEA494D0BD3BA5A46938FFF465935D505
SHA-512:	7385101C035B99DC53393D5E037A052F185D98D8D0608F1D206B2B397C6AAE232DAEEB53C3FF485ECE0BEEA0622E5689F2B92D91402526EB67CC945B860F63E9
Malicious:	false
Preview:	(....5..oy retne........................c...m./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:vQ8i0E/+Ll:I8K/+Ll
MD5:	404705167B60D02FDC2C5EBB92F9D4DB
SHA1:	493233804A86E4E679681D1A4841ECA6AA106A38
SHA-256:	C7A7DDA31B545EF44537673A561B96DEEA494D0BD3BA5A46938FFF465935D505
SHA-512:	7385101C035B99DC53393D5E037A052F185D98D8D0608F1D206B2B397C6AAE232DAEEB53C3FF485ECE0BEEA0622E5689F2B92D91402526EB67CC945B860F63E9
Malicious:	false
Preview:	(....5..oy retne........................c...m./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:vQ8i0E/+Ll:I8K/+Ll
MD5:	404705167B60D02FDC2C5EBB92F9D4DB
SHA1:	493233804A86E4E679681D1A4841ECA6AA106A38
SHA-256:	C7A7DDA31B545EF44537673A561B96DEEA494D0BD3BA5A46938FFF465935D505
SHA-512:	7385101C035B99DC53393D5E037A052F185D98D8D0608F1D206B2B397C6AAE232DAEEB53C3FF485ECE0BEEA0622E5689F2B92D91402526EB67CC945B860F63E9
Malicious:	false
Preview:	(....5..oy retne........................c...m./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.448177365217996E-4
Encrypted:	false
SSDEEP:	3:LsNl:Ls3
MD5:	29ACFC55D08EE1AE3A79A2C07CABE42E
SHA1:	70EDE0DEE9397BE6B47D8BAAA0246DC3922331AF
SHA-256:	80D1EF3F2102434F82DB0947DF465F39DD62B6C559DC65BFCB78EE6391425579
SHA-512:	2F6EE1014E3CFEB8E28E9E63F8F5E4D738C2E751656FF0B844B060D3751F883460910209EAAC9C6E913151B244D57311B184ADCEB7DBFDE668F6E73DB689F946
Malicious:	false
Preview:	........................................:...m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.448177365217996E-4
Encrypted:	false
SSDEEP:	3:LsNlTan+:Ls3i+
MD5:	63BDA4185E1C38DB05EF9EA53C8E9A17
SHA1:	A1A812247F7E6E4ACCF101F7097DC0A2CA26F512
SHA-256:	A1DDABA5904B20F98AE6BD4D32B855EC461C001C63B98A766378F456266BEB16
SHA-512:	228A0A8BAE5750CF7534C954449B9191D11C7BF3419C7365F1D3F873B72DF04EF935169B578427F23D79AE4583307D3FE12CBF96BA4113E2EE6FFB81F34EF764
Malicious:	false
Preview:	............................................m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.249456467923405
Encrypted:	false
SSDEEP:	6:N5O1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLlL50x+q2Pwkn23oH+Tcwt0jqEKj3K/M:N/fYebqqBvFL1ex+vYfYebqqBQFUv
MD5:	C28C87F453C43ED4D9851F953D3B78E5
SHA1:	A259B1217802AAA69E399235AA7399DA5D9D16CB
SHA-256:	5CC4C641AA98E5991DFA56A863774F74E81A637A4E961C27E1A02EE816A33EAB
SHA-512:	C4951B20EF6A39753F2A3C5637D7EAF53DD14771039F59CF9C24847474172B87E340B1AF3BF9629A8496194FABACED96F0028C0BFF68D5D912BAA8DC1D4CBD83
Malicious:	false
Preview:	2024/08/29-15:27:17.841 1d7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/29-15:27:18.383 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\167798a7-bd82-4aa5-b943-71e972a1ed93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1ce2aca6-9a35-47c4-b178-bec60bad4a32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1edee077-8601-440f-bbf2-fb5d8ddfbfd7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2e56b57a-522f-4668-b490-916748042d06.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3f4d1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.226062062823868
Encrypted:	false
SSDEEP:	6:N50+3M1wkn23oH+Tcwt0jqEKj0QM72KLlL5wuq2Pwkn23oH+Tcwt0jqEKj0QMxIg:NW+3rfYebqqB6L1SuvYfYebqqBZFUv
MD5:	B84E5E45FB33F0F2F94E2EE8B5312C00
SHA1:	9239C6CFE3AF712205E003B77EE6A057DA7B4D24
SHA-256:	C117FC385AC0B90BC23614D9A26071D60A5C9F03ED7963FB3F1FC4C2A74177D8
SHA-512:	F0A880B75E4925299BC3C8F5254743467BCC7AB7129D66AC87921797C3FB30772FBE5298E66EA8AE5BF44FAD2EF416FDC3668887B618F868136CCFA6648DD6C5
Malicious:	false
Preview:	2024/08/29-15:27:33.732 1da4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/29-15:27:33.770 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.242451346489466
Encrypted:	false
SSDEEP:	6:N5s+q1wkn23oH+Tcwtkx2KLlL5b+q2Pwkn23oH+TcwtCIFUv:NBfYebkVL1UvYfYebLFUv
MD5:	1E51FE992DF911BA74623CADDBE3EA1E
SHA1:	87B614377D11D2E6A68224DD1D271C1FC99C8F21
SHA-256:	A9E4B7C6C4DF3BB62200D121D518B2A4EC4AE530A1C9C717EB86599EB5CB05EE
SHA-512:	B2CF1433C65A2F3B41A31E116A42D79CAF747BB7AB1277D9E608084E4D0849A17298FF9F7A614F5C8313EA4A313166415C7480C8AC00EA6528EDAA0DEB0A0B8D
Malicious:	false
Preview:	2024/08/29-15:27:15.894 1ca8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/29-15:27:16.272 1ca8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVQM:IiVz
MD5:	9BD7B803DA46943FA314144A462DA402
SHA1:	5E0B6B777B447398AAAC4018DE2B1F054B24724F
SHA-256:	4AA125C6B565E5441132A1223347D18B2F69E690404A22EEE2EE4927EE2591B4
SHA-512:	9135A881B303D2226EF65485A3F87B08B255B87D07ED7573131297A69454D4FFE8318051D59D33619FE7B9F9ECBBC68EBE439E7B5BF145607956A97059603E54
Malicious:	false
Preview:	VLnk.....?......m...t..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.076911797428651
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkO4SAE+WslKOMq+vVumYNsmn66:e/2qOB1nxCkO4SAELyKOMq+vVum8p
MD5:	8562FAA86BB3561A100DAF203E95F18E
SHA1:	A74911B308A7F63C03B23D5185476F600B93E6AA
SHA-256:	DAF02A08CD996316F354AFF6EBE177A7FC1498C26762D0DC759B97158DC88DE1
SHA-512:	CBD21D0411117B6A105EE66321B035BC3E97DC60FA405226A733ED68B17A4DD0218087B76E42DB52BBB493F8F61ED9F3BDA02DF276A3D6B7335A63FEED1FDFA9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\a41f2727-b6de-4fd1-9c47-f1fc2a013082.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\adcef0b0-7539-4894-b086-b315ba750b2e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.973103975498021
Encrypted:	false
SSDEEP:	96:st4qfais18b9mcSN8zsAks85eh6Cb7/x+6MhmuecmAebw1+2Mi/EJ:st4MsySNksAks88bV+FiAV+PiMJ
MD5:	3073A4CA0C76D20A75AEE7DF68BE5124
SHA1:	B4C44D2415B45582C62ECA7161204FB576A6BF02
SHA-256:	3595BE9A5BF128231F14C9D75301F24AA3B150779299B941A55E971A366BD99D
SHA-512:	06B8D65F0CEB2D787DBAF7F245D8EE2793B4A02FF66F551AA6370A0E2995FA3C3F22CF514E9D2F86545E8BCD57468B2D531EE22F13DF083319A03A0A0D5FFB37
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369433236325939","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369433237641960"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\fcd88825-b9c8-4d83-ad12-863daad4306f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/CBlFll:7+/l/
MD5:	8209A9C91440D8C0870D2684EEFB5C20
SHA1:	D14CECCAA55C3B0BD73819D678CBC39F38F1AC42
SHA-256:	88836194FA06B2E749B54406037475D9B022ACCF496C890FBA463E1E8F2A9EA7
SHA-512:	650C6E5021AB9E56BE230F746CE592730F6E35F44047C4052120DA7EE1A692E1ECA2963C17D65C36401BBBBDD7390959CA40D7382D484D6D2301EB6D2A5D69D3
Malicious:	false
Preview:	.... .c.....g...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04998394447396411
Encrypted:	false
SSDEEP:	6:GLW08vOtd/cHYlRW08vOtd/EllqL9X8hslotGLNl0ml/XoQDeX:ayoZqlAGEjVl/XoQ
MD5:	7AF1994F472B9FD345CC0BDEA19DD0DD
SHA1:	D8578A550CF919FB0F455965F71AC751BF036BE4
SHA-256:	8556286B6DE8ED3BA493E33D90FBC7AFD939991D1F517E243A8242B43B3E59AE
SHA-512:	F1B4B71EDD226A2A21A0DE9FB9B3DE37F84FA06BBD8653E62B7AE843D368830E1D2625943B6EA2CB8C6B217F9EBB058C4D4CE36FD13C5F2DA0D2B6B2CAA10797
Malicious:	false
Preview:	..-......................+.....b......]3#!...N]..-......................+.....b......]3#!...N]........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9995311609207642
Encrypted:	false
SSDEEP:	48:YzxfQkllO+ncbX+6Ln9VAKAFXX+u2VAKAFXX+ViXxOqVAKAFXX+wXnUYVAKAFXXf:oxokZhJNs6NsVMO5NswGNsWz
MD5:	7340178F97EB9A32059B25A1427CE458
SHA1:	C1674795B2B25B29F37ED57CA03BD1E311EC9423
SHA-256:	5BA5F36D59C63CB77AC833428BF8496476156B6BD9A552B54F8BAD6BABCBD51A
SHA-512:	6FC63D544BD7CE8BBF57DBA5FBF47E5A99A56ABE27B9797504EB2B0242402398EECB14DB11976E39C4DC2BE2D43C091243AA903AC25A5247AE94D5B40BADDB95
Malicious:	false
Preview:	7....-................]....P.E..............]...r.P..SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1535
Entropy (8bit):	5.494473545410141
Encrypted:	false
SSDEEP:	24:F8wSBSTc/o/ePlL/HRHlIITt2YKIt2YKwKcVQNkQzMYKIMYKHayGAlkfAlkLW3Jd:F8wSBSoQmPJHRHlxTIYjIYVzVqkEMYjE
MD5:	3DBF87DA2330CA8B76B2C7791D5B28F9
SHA1:	73653F5E286468DDF23B8FE82FF3C1DAE357E21D
SHA-256:	4DB7F9174A34CFB9FD01EB3DB8B05F62DD160B7D485732F59D748D2936201BEF
SHA-512:	877148990180712B5CB175842E066A7910A4AF3F1349604156EE94D19E49B252D88818DDD6FECF6E463E49005FF8D1D456B349978B87EFCB456FCF965CC1EA1C
Malicious:	false
Preview:	A..r.................20_1_1...1..F..................F...................b.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.28804566219554
Encrypted:	false
SSDEEP:	6:N54Vs1wkn23oH+Tcwt0rl2KLlL56M+q2Pwkn23oH+Tcwt0rK+IFUv:N8fYebeL1x+vYfYeb13FUv
MD5:	AB5DD7B074CDB60AEF4EC8E36F147547
SHA1:	CD8EB754DA52F2615A70FC4F7BF56CA1D8A59C77
SHA-256:	CEBFBDEF85868A239423851457C5BEFEC91FAB437AAF95302394B7B5784210C8
SHA-512:	258F80935F0F06EE407CA7C29EDE3F17266A394E1BEDB7F7D70F5776C7CBE58B4BB6F256DB2FA1A3CB5CE4BCAFC7022281E592D5D98AB8506ECDF6C518AE8B1D
Malicious:	false
Preview:	2024/08/29-15:27:16.367 1cac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/29-15:27:16.376 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	3.956227439378081
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVZitTqlIZfkilH/23MRoFXH4egRU0:G0nYUtypD32m3y3lIZMGfl
MD5:	185D151528E66999CCDD7B2BA9D87641
SHA1:	039DE9E7DB81A9888063DC643FCDFA4B45AF5A3C
SHA-256:	574D5E6C9B217992015BEC68AA3A998EF4F3D43087C1E7732FBF0FD4062B35F6
SHA-512:	313A76ED3B9C7A54043BE8BAEE5B30E3D5BF552D58F96D8DC7EF9F781F2120F1BFEE751AA10CFF4CA7622EF8B18067F5A1F536590FE53F6D040AABD46F661C12
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......N..................3_.......`.................38_.....Owa..................20_.....4.9..................20_.....B.I..................19_...../..................4_........J.................39_......ort.................18_.....R....................37_......7...................3_..........................38_......-D..................4_.....LZa..................39_.....D...................9_.....^...................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.24817973141077
Encrypted:	false
SSDEEP:	6:N5Vs9s1wkn23oH+Tcwt0rzs52KLlL54BlM+q2Pwkn23oH+Tcwt0rzAdIFUv:Nr0fYeb99L1OW+vYfYebyFUv
MD5:	C434952FC0DA54D0896EE29213FEF1BF
SHA1:	05CE30D22EB4CB2355C3477464A99ED7CD2E495F
SHA-256:	ED9F53B7DEF512EE145046C90D0297120EB31588BBE3C8ADD5A39B3606F7B76B
SHA-512:	37D90E9FC5470BC6C3D57D45ADC079D26567B077E54AB19FB8D2E779DFDF942C33E9BE803216AF6D95843D564C91E001B3FD4C5D92D8FF1E83665837CF1F7AC4
Malicious:	false
Preview:	2024/08/29-15:27:16.356 1cac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/29-15:27:16.365 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlUT:Ls3UT
MD5:	5E3DC215B6B2A0FE3996ECEC3EBF2511
SHA1:	A472BADAF34533993446303275FC767BFAC3A77D
SHA-256:	45BBBE93518D29619D1660CD5E66BA0B238785203E28AC01D9D3061D0164F433
SHA-512:	69BDB487D3132583EA808F55C55C362FE4D621A25AE07BDD6F2F0055FE7068D8A6510B0D05C4545A19CD69372BE5295A72C4617C18334ED8C56AA00E387FC5D4
Malicious:	false
Preview:	.........................................p..m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlpa:Ls3p
MD5:	E0E7BE40A3A09C6134DC64616720F706
SHA1:	E7A42785A153E931C0582891B0EC5151D7059AFA
SHA-256:	3B4FDC2B053C981C748F28843F53C0CE46FDBFA05A9DA360C3A76E6B185CFE56
SHA-512:	177EF55441A3B3245822A0C3948E130AE9AA58EF788BFD585E08B69C4E4568D68E320800F32205D7347752B53D9DB33FC248B006C938F56674F0C8A50A187806
Malicious:	false
Preview:	...........................................m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2c588.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2c72e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2c75d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2ee9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF316d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF35891.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF38cc0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3b130.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3d860.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF43804.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.520289304975203
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt2x/0u+xZiQBi3Tr6yikWfJdXBuBuwBgWaAavkNhKRXWvSpQQT:YuBqDPafQx/p+xZBiglgBzBZO+KR/+B0
MD5:	74E12D5103B7A96914EB72B43052D8FF
SHA1:	E48B5AD0B8B2F3AEAF153BEDE394C404D6C0B649
SHA-256:	E0D9EFA0B9CBC63B0698793C62851F05168CFFB457B4BDF50B5EC92CDC2974D1
SHA-512:	E63BDECDC29202552F337A64048B7D2831213EF7937793347D3CB61B23E65FB4AC05CE043711036155ABD94C2FD8195F7DAC06A059999D03D447298DF3703887
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369433235294804","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724959635"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlMOl:Ls3MK
MD5:	42ACE198BAC48848A7B88620E5C554DB
SHA1:	09DBA560A94AC62BBA5EF377C8284EBD04585F89
SHA-256:	6578E397D54267D2EBDDC864CFC86B0C5FB7A4D5F1D504F343DF8E4A4200086E
SHA-512:	F9DD71CC7A4DBCA014A18030933D61B1DD44DE6277A9C7380CE29AEB4257AE0800DD81752BF65B67C18ADE10F9A5D27F86708CBB295AD78C4BF46886622F3A5B
Malicious:	false
Preview:	.........................................h.m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\a585301f-ad0c-4377-ad51-a0eaa39053c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20988
Entropy (8bit):	6.062105154087827
Encrypted:	false
SSDEEP:	384:rtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSZCpxdWWKb+Mh0lkdHd5q6q:BMGQ7FCYXGIgtDAWtJ4nYjdWWKfh02t4
MD5:	B3BBE451ACF5C6EC0A9AEE74FC912F25
SHA1:	F8438307D501D3CF41848FD36F5CDC5DB0BB252C
SHA-256:	A2157CC4E13A4BB53B2F41253274AE2C4F6FFE4BBD245385FE3BD9A58CDDA63F
SHA-512:	47734FB8792119269BD3D3CED53654B75C4FC647C0CF75ACF7DAE83E1F0C6F01710D7492B516E49CFF954056A8E3D1FF15505FE8F5A3DC8C84C5D94FA717F81F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433237694284","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\b03cffba-cae6-476e-94c8-bde8a4ff38cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20988
Entropy (8bit):	6.062131303212625
Encrypted:	false
SSDEEP:	384:rtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSZCSxdWWKb+Mh0lkdHd5q6q:BMGQ7FCYXGIgtDAWtJ4nYydWWKfh02t4
MD5:	C914111035C0DFC8674B1E76BB953075
SHA1:	AFE1D86B9EE1A9794310BE1627687A8BE794B094
SHA-256:	A0A264ABC9608DD1584F7B14E72023CB37366455F2ED910A19B7EB975ED8F65C
SHA-512:	A5D9EEB1D67420DA554EDB874D8F1FC4EE2ABCCA10D6D5610D3CB0C5867B468B825EEF2AF21D5BDAB2F7DA6F599EE05246805E3B4B40A9A1EC5E4F3CA07AE321
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433237694284","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\cbdfe07b-3c9d-468d-bdac-8d93ad6c8a8a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2956
Entropy (8bit):	5.580702500407227
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afQx/p+xZBiRlkHB+/drx3DvBZOtoRtXaJkX6cGBFwgMU444C:Xq8NkC1fQZp+PgREBwVDvPOStqJkKc5G
MD5:	7BE15F808C80CCCF87C45ABACE33C7A7
SHA1:	302F5021ACED3BACA8671733827CF377E619459D
SHA-256:	F1B05EEC9EBB7821E3EC0A5FBAB4D4D3A3965B838B2D9DAB9DE695D9A9FF1EC2
SHA-512:	5D8C810A66C174CDC4F782F1A011F4BD4456654035FDF5A1B2D1B132BA53E55905A3F2213E500414DD080E65EADE32FB395B227FC6A14D0D2128A297DEC3BF14
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"policy":{"last_statistics_update":"13369433235359103"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\fa02b061-eb7f-40dc-941b-2d83a7b48ff1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3329
Entropy (8bit):	5.561354032047045
Encrypted:	false
SSDEEP:	96:0q8NkC1fQZp+PgRSQBwVDvPOVszJkKcxoRI4a:/8NbSp+P0MSsFkKLk
MD5:	20BCB9B50F4C609AB6A115CF3C355828
SHA1:	99543871F4376435E784DF530F02505B364C0FA2
SHA-256:	8DDC5AC862EC1A0EC7448808787CF811EFB85E1EFE82EC071305F4A11E25AE97
SHA-512:	D50FFE8D21399C9D3FC5EA24BF965A5D92CF9CBB84A18BC8148A96DC715648A5EF1CFA0CD2EF845A480139802B3B121ED4B2EF34CE0545229B832A66BBB3774B
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABDDSzOneVn3K5KdrzfZZTVpxzKLFr/MQbkHiw7dcrnqgAAAAAOgAAAAAIAACAAAAA20EfkK6aKczCi6tKd9/VFA5/5oFQvm9c+PzcteQ7JHzAAAADJ3WxES2KjQH1udY0ZUfmFdJhve5ZmvIZSsRmZCyGy4c8iumuMW1B2rqj2S/hpZIlAAAAAJYjk6QOyI9sHkacVhaL0F71zJ9t6jQm1DMOoXiAv8R1Dpmi7M809pMXwR8dsotMpRk17pSFtXAiXqahRiZhttw=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\416ec676-60a3-4d83-a5a3-dc724c64389f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46843
Entropy (8bit):	6.081797890327857
Encrypted:	false
SSDEEP:	768:3MGQ7FCYXGIgtDAWtJ4nmi4JhDkAdMfP7cr8BrZ6yyOouYg8TC5z7nh02tdu:3MGQ5XMBGHV7G8J9ljZ5zF2
MD5:	E57DD10DCF068CCD4F0191AAAC837A86
SHA1:	FA2025D8F838DE073EFF01249683ADF284BE93C9
SHA-256:	8D7F4C2A5D544C51D347093D51C9E3D4314FAA0464ADB155EF4D8FBE96376009
SHA-512:	5C8AA452B410BD77709B7E64A553D49EA4CA2CB3FEC98D7D02548A539B1559367B90940097098F8DD84B5F16E46B6D4E3F404D5E7A66A9BEC50FDBEDA071EF7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433255277069","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\41c36cd6-f074-454c-ab7a-a4110689017b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.803906082947208
Encrypted:	false
SSDEEP:	192:fsNAkp+ZY1CeeiRUxyxQuXkKr6qRAq1k8SPxVLZ7VTiQ:fsNAQx52yOlKr6q3QxVNZTiQ
MD5:	327C9F598691C97633B219A9B678F385
SHA1:	FCC941FFA99686C7B0730FD96105B575D8FC8D45
SHA-256:	E0A0E673957CD0189FFE7A6F1BD0707042EB73FEDDDF96A6F24726C0C6803422
SHA-512:	D393F257DB9C8ACA83078C2F6CA7B7BA2C9D84AFFFC103A0548E3E464536CA837E8F3AF25B12634B4E56423DC3697733AA26EFCAFE95486BBACF5EA253ED6A72
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\47b32495-e060-4bfa-929c-9d93fc08cabe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4d98cac7-8fc4-4c34-9557-1d5e173e31b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.797345555356615
Encrypted:	false
SSDEEP:	192:fsNwkp+ZY1CeeiRUuycQ8kKr6qRAq1k8SPxVLZ7VTiB:fsNwQx5PyR3Kr6q3QxVNZTiB
MD5:	8C047414A33C3B0DA40555A5BE65F82C
SHA1:	6309BFC8279D0634F766035C374739E28EDB13BA
SHA-256:	D7260EBAE691E4BE3C994B0863B6140535669D09CFF093BF424B4FBC5D966806
SHA-512:	20A48C9D46C2E81FE8FA4DD807E765D9F48573DBDC1F4DF0325DD1281CAFD38676C428B0A91EC1490A6808C23A1475EDAFDB8027DE40DACBDA8B1F4FCDB4B5DA
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\57bf1052-ac51-4eb3-9b34-831ff0e81466.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24685
Entropy (8bit):	6.053261441659597
Encrypted:	false
SSDEEP:	768:3MGQ7FCYXGIgtDAWtJ4nmi4eC5z79h02tdu:3MGQ5XMBGHi5zL2
MD5:	8B385B1C609103E0B2D7E349386A53A0
SHA1:	B544EEF943215F8ABE205C1F9202745363BEAF8B
SHA-256:	6E0CF355BD64DEBC011A1D2B8BF9D839159EA302348027835C6B3DC57B6F9C28
SHA-512:	A5B5783CF6449B734E3A5DA8D2D1D7880597C3B4E0CE3C3BC8FCEE8F5453AB981D7B3971A25DDA992F0E56744BEB1F3B4F4426786C52F0B5FCF387EBFEA2AD6E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433255277069","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\64bbf237-598b-40b1-a011-5ab2f7e270aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.831134176497583
Encrypted:	false
SSDEEP:	192:fsNwkp+ZY1CeeiRUuye12Q5fWjrkKy96qRAq1k8SPxVLZ7VTiB:fsNwQx5PyWF5fMoKy96q3QxVNZTiB
MD5:	B4A3D15FDD31F22F6C9D917DD06B0355
SHA1:	E64B182780650A0E1A376CED292CBA928D309F4D
SHA-256:	D5BD64ADC31C8678B5F187B376D80C948A39D380949E7704A99CC8ED0BCDD92C
SHA-512:	C8445650C79636DE4304DD8F0352CC67EDCCB8AC9E17C58F04D45A3A56D0431AE8E7B8C924A8F14BEE78263C4873D002D4680B26EB3AC3935BDFDD04CF3F4343
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7a028052-87c2-45d4-a388-9eb91402c8a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.831233809946089
Encrypted:	false
SSDEEP:	192:fsNwkp+ZY1CeeiRUuye12Q5fI1wlkKy96qRAq1k8SPxVLZ7VTiB:fsNwQx5PyWF5fww2Ky96q3QxVNZTiB
MD5:	432388C37F9B3127B6842FD25912AEA9
SHA1:	01D8253FEBD2CA96B2623D14D9A834F016742920
SHA-256:	CB8B2FB378AD4378CDD1930C80DB85BE25C29961D0750DE2508F1C5BD83602FD
SHA-512:	A36C1206DC3CDF950B6E5F8C0F084F498359AAB80F11F75F2705D4CE8423D7E311D02A425D9668E5FB654AEFF2306C07BC747284AC6799BB6E24587F79EA8A8F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\99f06f2a-7e6f-4cc1-8867-5c156f556c3a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.831118924135829
Encrypted:	false
SSDEEP:	192:fsNwkp+ZY1CeeiRUuye12Q5flyzkKy96qRAq1k8SPxVLZ7VTiB:fsNwQx5PyWF5f4wKy96q3QxVNZTiB
MD5:	EDB28FA43F623046A475D7A87CA0A968
SHA1:	48422CBBC3A63CA5B3DD466A642E93F689B01427
SHA-256:	F64ADD31FDF77BBD5CB8A1BEBE86AD893BC99A250286275D6B9FD50563FF0CD5
SHA-512:	61F400B62A6DF4B4FC31DC06309972B8B58885298B9FF5197D1F0DF2CDC9F2284F57AC8FD14FD28A7CB1AC019BFBAD0E001A123155ED3F61BF167E876358B29C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6509c85e-b7d8-4394-b2f0-ce706bc31516.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D0CBA6-23CC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3106804817479403
Encrypted:	false
SSDEEP:	3072:7UVXTb44L8zuMaV9AFm97RJjrNmkkjpdb0Ajb590mIkteP/S74rqvR3AfiUChbi9:KYY9tmkQb0kDVicaHsKnV
MD5:	EB874E31F8F32E4AA7831970733C9A21
SHA1:	A816BE3A643EF36846592E2690D8AD85E89FD407
SHA-256:	45FC3E8E557D46CECBBC79D11C67AC97D4EA3089ED7B6ABAA85BD8D8F3729846
SHA-512:	54D89A0494FD25AE1CD1F12A9155697A3AF2360396738850CF5E89799B719639B1BF666F4F72CADF0A67F7D5D26ED1CC42DFB89E4C7FA6C313D35820898A1480
Malicious:	false
Preview:	...@..@...@.....C.].....@................Q...Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".taxdgp20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D0CBAF-828.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03969732383894474
Encrypted:	false
SSDEEP:	192:xQ0EbtmqvDtKX7yJEa3XxxTVwg7XSiV0DA5DhAVN/K+O1gQtmBrGq01n8y08TcmQ:e0EtFeQtTnhUHag9ByX108T2RGOD
MD5:	D8B9E7AD481130667D5F138E1788347C
SHA1:	D0EC150EE7F8C296E0F292DEEE72CA553CBB5FE2
SHA-256:	553BA9168F5773258E1E5D1C036D8A05E2E8B44EEFF07D50E7829178383AFE88
SHA-512:	CCF20DE228B4B8A77893026D502141C254B12935B17CA527569A024F83FAC87DF5AFCE5670F00AA658D5D8E191B0C053A141F1C55186541BE1DF9C7B11787B0E
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".taxdgp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D0CBB7-1FB4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038829872522243625
Encrypted:	false
SSDEEP:	192:dZ0EbtmqvD3KXGJta3Xxx7UpXxgg6zfhotNEE7Gtx01gQ80qZFq2n8y08Tcm2RGY:j0EtrTZVQh0xWagAqzh08T2RGOD
MD5:	0A7A0BB10F4DF2832E681EB4C3E16393
SHA1:	46AC820DB5CFE94A021086840F1737347E72FF27
SHA-256:	3F43774F16D5D436A03F77316EE8E22545E236FEB96AEB591B2FC89F032DEBC4
SHA-512:	46FA6CC1E75C600D724137A6136A926FB25DAD6F0526B536482F0303967B1709F36D2EBF71CA409D508406A90A5D0AA2A370B6616EA4211AC8E7658430222DCE
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".taxdgp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D0CBC4-15B8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03883363227364849
Encrypted:	false
SSDEEP:	192:dT0EbtmqvD3KX7GJEa3Xxx7UpXxgg6zfhj1NErZGtM1gQMC3OX0q2n8y08Tcm2Rl:x0Et7eZVQh5WWsg+35h08T2RGOD
MD5:	4C57981C2589A2FA5B003E2DE667B830
SHA1:	8BBD7AF4BA3F4CE33FBF668544FC64B66498DD7C
SHA-256:	45314CA2CBA673CCDEB61BD7B3806887A0703A59BD94F59AF06424F592792894
SHA-512:	02C71E47F2A11C03A0F9AE230588CDAC4CB6283644D7FB2A4556DDB4D2D99AB8E5A1ECCCAF3380BF75D66F92AD95FE8D9041D536984F6BBD72544A7449819CAC
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".taxdgp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\173353ae-8f3b-4644-8fee-9822d083d707.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.565349747292955
Encrypted:	false
SSDEEP:	768:Bsdx92e7pLGLvNoWP4+fEy8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9hU2rgsrwWpBG:Bsdx92ecvNoWP4+fEyu1jaEhU2gFYtk
MD5:	1E23A3DD78D9DDB86AC3FC9D4F3FD91A
SHA1:	F23C10A2433C11C10527C2FCEE8C895CCE2345C2
SHA-256:	890AFA4428D298F21E4EE06DABD5547BD4ABA6066541F5617C715479154EE736
SHA-512:	B306D9C299EAD05715969F34397C23C1E316A436789B88BACA2DC2F1CBC2A06A5EB959DA7594A7428F8F4095910763161E3615E88488C170F547436D4E59FE25
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369433255010814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369433255010814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1913faee-af93-4605-ab69-0bba88c25b43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3f280059-456e-49e1-b0fd-263bd4c8b457.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.189446969013149
Encrypted:	false
SSDEEP:	96:sVmqltJ10b9c9cicglX5nuxV4o7YwsY5Th6Cp9/x+6M8muecmAeCkRe4zvrJ2X6p:sVmeJQhglti4o7YwsYPpj+FVAuJFBf
MD5:	06CD0DA8EE34159FBADCE684B32875D1
SHA1:	A451BEFEF4AA70903670C9334F9876C5787415E9
SHA-256:	93FC28B5BCF0D0D71D1705E1552DC625C174895B1DAC4FC9F03930DD3ECA5EA6
SHA-512:	FC4E1CC01CF1815F0CD4CFC2E1BAD55297B85C5084341F1E7E9B9CC82B3D95E594A8E11BF95BC86FD4987AFA46F0711BA88D3A4FDF63C6B1E5E190CCCABE05E6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369433255229522","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4b43b439-0ca0-4d57-8d5e-54683376c448.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557252165833772
Encrypted:	false
SSDEEP:	768:Bsdx92e7pLGLvNoWP4+fLy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVf2rgsrwzpBtur:Bsdx92ecvNoWP4+fLyu1jaG2gFHto
MD5:	0D34452B027FAC8894EEA05CAD1138D4
SHA1:	FEE139A212743C88922CFB2C30B43A7696195B50
SHA-256:	2202D6E0FF4662CB50F45F4BAC1733805701D95DBD44550AD9966B9E492C2E96
SHA-512:	415916E4A02CE90416C2E895413739452527E90B941F8146459D6FD4FCA00FAD0171C9991FEE43673A2BC466017C17232482A57680E1702142A8342B4ADC1ECC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369433255010814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369433255010814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.32164320340096
Encrypted:	false
SSDEEP:	192:XAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:QOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	DCCB66B503389CE96285FAF878CFFADE
SHA1:	2D1142433AEF479EA725AFEED43A15A436D8B632
SHA-256:	68327A5814C88D327FA39118E6D22FD3778B410EC266AD2CECC34EA368994DBC
SHA-512:	EE380ED45010C2E28399DF4671AE4ABCFACA4E4B777F021EAADA70276010D08E3C38F0C46CAB5E2A2F3C1546CE3552AC2EB42BECACBB2187F582CE040E9B8C45
Malicious:	false
Preview:	...m.................DB_VERSION.1...................QUERY_TIMESTAMP:arbitration_priority_list4...13369433258268752.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.137085741455072
Encrypted:	false
SSDEEP:	6:N56LtD1wkn23oH+Tcwt9Eh1ZB2KLlL5ycM+q2Pwkn23oH+Tcwt9Eh1tIFUv:NQZyfYeb9Eh1ZFL1c9+vYfYeb9Eh16F2
MD5:	720496A07F032584EE065F3F3008BE3A
SHA1:	08D6F5B636D28B92EC6C133D7E46A1FD1FBFD5E6
SHA-256:	561C45D22B7A07A6AE24063511096DB3A860D7F606E1CCC2BA56E543339DAEC9
SHA-512:	4015CCDE7FCAA1D8055D0CBAAD937FBAA266F838163A0B5BF1FA2EA7044512141E2C2944C676D6EBC530EA78B22F0EF29A03F2CBF1EF0916072AB6F315691338
Malicious:	false
Preview:	2024/08/29-15:27:36.905 a1c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/29-15:27:37.087 a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlCE:Ls3h
MD5:	A7807B111F6F751134004AD247882F1A
SHA1:	9ACA658FE4282418DD3F899B89704819151942C7
SHA-256:	CB0CA193BF5BF0564F1CE5BDC60F77BDDE61DFD969D40B7154D857710ABD7DF8
SHA-512:	4557B986ABF8F8C2C5A2902AE9FCC888A15FCAF16E3BE211E36771B5E0DEBB732F6F66A7FF340D5739E1159182DACADA0097EE2FA8DFA0076E51A8760291685C
Malicious:	false
Preview:	............................................m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.23906148962395
Encrypted:	false
SSDEEP:	6:N58rQEq1wkn23oH+TcwtnG2tbB2KLlL52+Vq2Pwkn23oH+TcwtnG2tMsIFUv:NcQE1fYebn9VFL1o6vYfYebn9GFUv
MD5:	251B3368EA341BDCDEBDCFFB103F8594
SHA1:	3E85E8A2A858221DEB8FDFDAFAA207ADCB6255C2
SHA-256:	5949EDF09CB7FE3BA554A29900189C5D4F8CCFF91B2C2716BFB6B8CAE8A27A4C
SHA-512:	DFDE8CC4DA84CBC61FC8372F6D885F0BA95EF0F53DC79FC2153D68C8B991CFDE470A2E15D242A586CED493588A968C971135A2D1F3FE69A03DAC07353B04C7DA
Malicious:	false
Preview:	2024/08/29-15:27:35.009 ff0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/29-15:27:35.466 ff0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.202301768295043
Encrypted:	false
SSDEEP:	6:N52Z0B1wkn23oH+Tcwt8aVdg2KLlL5FWN9+q2Pwkn23oH+Tcwt8aPrqIFUv:NwZ0kfYeb0L1M9+vYfYebL3FUv
MD5:	12D512131BB668F44170C449C6F4FA0F
SHA1:	C9D5F32B6ED85031B4AFDA811F33864322068071
SHA-256:	3EE99026D03B51A3388EB9E4B854628441505F5021648B0C94330B3CF3234297
SHA-512:	403F1C5FAF44423B7226D76A5E53EC699178809B1806C6805D8C9BB69081C55EBA5BAAC47AF1250971D600B288C0624F109376621F78D5386AB3AA3B0AB69A60
Malicious:	false
Preview:	2024/08/29-15:27:35.011 134c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/29-15:27:35.113 134c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	283
Entropy (8bit):	5.218968898878822
Encrypted:	false
SSDEEP:	6:N5FlRmhRM1wkn23oH+Tcwt86FB2KLlL5F6Mq2Pwkn23oH+Tcwt865IFUv:N0rfYeb/FFL1yMvYfYeb/WFUv
MD5:	EA1AB025170FF6335CE400B1B7900D25
SHA1:	8C1328AD5757D1F56B5CFA07AFC951CEE641BD44
SHA-256:	304BDE64BFC5C527D4ED037B92F940ECED3CB39D7A9B76AF835177EB93AB1807
SHA-512:	E589FA1FED1C145B64ED34B752B66487DF630B240D1DDBDF2A3015E3EE2D67340F6C5C13D6E18BF232D3B217E5AF3116E32D91CCCBF941870EC6BD4A741EBCBA
Malicious:	false
Preview:	2024/08/29-15:27:35.121 b74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/29-15:27:35.137 b74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.167343498645232
Encrypted:	false
SSDEEP:	6:N5KQq2Pwkn23oH+Tcwt8NIFUt885byZmw+85b+kwOwkn23oH+Tcwt8+eLJ:N8QvYfYebpFUt88dy/+8d+5JfYebqJ
MD5:	E386A0FBF746025D4DE3035A8B0921A3
SHA1:	9E8B8B69A2FA6A98367999003DA028A0D2E4EF28
SHA-256:	C84858C0F2FEBE4DA70EB29BEFA8CAC4E9AE51A6D1277200C8BE27C78AC8333D
SHA-512:	72DBDA7ABEC4755CA8EAEDF0BEA0FB9179C2F4B796960E953E01E8B7B7198258BE71C78B81E112E44E1EDFDFE10BBA815B89FE7BED969BB47475ABE1EFB61C86
Malicious:	false
Preview:	2024/08/29-15:27:35.289 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/29-15:27:35.290 2090 Recovering log #3.2024/08/29-15:27:35.290 2090 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.167343498645232
Encrypted:	false
SSDEEP:	6:N5KQq2Pwkn23oH+Tcwt8NIFUt885byZmw+85b+kwOwkn23oH+Tcwt8+eLJ:N8QvYfYebpFUt88dy/+8d+5JfYebqJ
MD5:	E386A0FBF746025D4DE3035A8B0921A3
SHA1:	9E8B8B69A2FA6A98367999003DA028A0D2E4EF28
SHA-256:	C84858C0F2FEBE4DA70EB29BEFA8CAC4E9AE51A6D1277200C8BE27C78AC8333D
SHA-512:	72DBDA7ABEC4755CA8EAEDF0BEA0FB9179C2F4B796960E953E01E8B7B7198258BE71C78B81E112E44E1EDFDFE10BBA815B89FE7BED969BB47475ABE1EFB61C86
Malicious:	false
Preview:	2024/08/29-15:27:35.289 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/29-15:27:35.290 2090 Recovering log #3.2024/08/29-15:27:35.290 2090 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3281731663735024
Encrypted:	false
SSDEEP:	6:P80A/J3+t76Y4QZZofU99pO0BYXcqR4EZY4QZvGG:8hHQws9LdmBQZGG
MD5:	9B02664CA54CFEEE7FB496C8C7856845
SHA1:	CA2847985C9114B73F70D4D1A073C674AFD3C330
SHA-256:	43B26727D3E3B80113EABC363B296C98C0823499A42639D957B1420D569F7E33
SHA-512:	CCFC961603055FE2BEC2E16D40D04C66FEEF1C492D68FF4FD69D150127B1E2F74F23BBA5EE0CA461CEBDD4BFD6D1A6CA86C90AC4BB7495503B5397106B09B238
Malicious:	false
Preview:	..............y....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.311888040533256
Encrypted:	false
SSDEEP:	12:NaL+vYfYeb8rcHEZrELFUt88iW/+8JLV5JfYeb8rcHEZrEZSJ:NHYfYeb8nZrExg88DhJfYeb8nZrEZe
MD5:	A5888E1B658908F641389119CF8723A8
SHA1:	DDFDC2AD1FBDC437CF7194E6F00A76ADCA877B70
SHA-256:	E637EE81FC79945A6EAEDEE91A2D928FC53DA817AF2FED70AF25C1022255DF40
SHA-512:	6C05631A5350FDA128F200257FA31DC126F6CF91EA2C38DE9C7A52124094F0679FB4CB05950DCC283CD5A63413A79757B7FFBC66FF754C780C9409B9219BE3CB
Malicious:	false
Preview:	2024/08/29-15:27:36.340 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/29-15:27:36.341 1e3c Recovering log #3.2024/08/29-15:27:36.341 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.311888040533256
Encrypted:	false
SSDEEP:	12:NaL+vYfYeb8rcHEZrELFUt88iW/+8JLV5JfYeb8rcHEZrEZSJ:NHYfYeb8nZrExg88DhJfYeb8nZrEZe
MD5:	A5888E1B658908F641389119CF8723A8
SHA1:	DDFDC2AD1FBDC437CF7194E6F00A76ADCA877B70
SHA-256:	E637EE81FC79945A6EAEDEE91A2D928FC53DA817AF2FED70AF25C1022255DF40
SHA-512:	6C05631A5350FDA128F200257FA31DC126F6CF91EA2C38DE9C7A52124094F0679FB4CB05950DCC283CD5A63413A79757B7FFBC66FF754C780C9409B9219BE3CB
Malicious:	false
Preview:	2024/08/29-15:27:36.340 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/29-15:27:36.341 1e3c Recovering log #3.2024/08/29-15:27:36.341 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.199242660103712
Encrypted:	false
SSDEEP:	6:N5DNq2Pwkn23oH+Tcwt8a2jMGIFUt885DMZmw+85D+kwOwkn23oH+Tcwt8a2jMmd:NpNvYfYeb8EFUt88pM/+8p+5JfYeb8bJ
MD5:	0F85FBA0F2ACEE8DEDE3AD4A700A5B6D
SHA1:	FC444A59E07931FCE92A3652BE28183F95CB6F5F
SHA-256:	27793C2273ABF9235E2B66E52A21A3671CD571F07B65A7C7EF589D794F3D9BF8
SHA-512:	456696C026FD44C538A8FEC6DD378A5A21B7411B83CAE003E9D0F68F9B9A9EF2B48D9731620A0D280B5A69883D0B264EB9CD30C926AB8869F1D91B5AA404BCF8
Malicious:	false
Preview:	2024/08/29-15:27:35.745 2224 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/29-15:27:35.749 2224 Recovering log #3.2024/08/29-15:27:35.754 2224 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.199242660103712
Encrypted:	false
SSDEEP:	6:N5DNq2Pwkn23oH+Tcwt8a2jMGIFUt885DMZmw+85D+kwOwkn23oH+Tcwt8a2jMmd:NpNvYfYeb8EFUt88pM/+8p+5JfYeb8bJ
MD5:	0F85FBA0F2ACEE8DEDE3AD4A700A5B6D
SHA1:	FC444A59E07931FCE92A3652BE28183F95CB6F5F
SHA-256:	27793C2273ABF9235E2B66E52A21A3671CD571F07B65A7C7EF589D794F3D9BF8
SHA-512:	456696C026FD44C538A8FEC6DD378A5A21B7411B83CAE003E9D0F68F9B9A9EF2B48D9731620A0D280B5A69883D0B264EB9CD30C926AB8869F1D91B5AA404BCF8
Malicious:	false
Preview:	2024/08/29-15:27:35.745 2224 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/29-15:27:35.749 2224 Recovering log #3.2024/08/29-15:27:35.754 2224 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1ff05038-676d-4885-8679-71f22fbfdfe6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\784d133a-851c-4c80-bcfd-b7d8f43a00bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\977eb85d-3a3b-4ff7-950a-83f7f6132399.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9a13cc88-6e8b-4716-bf3c-bbca01ea8982.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF34065.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF39338.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF42d65.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF319d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF324fe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF34065.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a83ec1d0-735a-4605-8447-a0e195028c15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.297847854733481
Encrypted:	false
SSDEEP:	24:YXsJlZVMdBscZFRudFGcsVZFGJ/dbG7n7:YXsJz8sEfcdsjgzbg
MD5:	59567F30ACBA15BE050D361E32283DA0
SHA1:	2603F02145CF91ED1F255F770A892307B850B4EA
SHA-256:	C212F6EAC03DC58B9ABDAB821411CDB48F7A6E513ABE65F4DDAA665AD5D2ABB1
SHA-512:	D00B8C8D97C8C687060265213192C10F7B7E8488B5FA9ADD49354C89C52D2AC21E627009D8A5CF462C5B1F25E3E34CB5E72D58C75B3C1C76C1173F162B2DD9EE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372025257615127","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372025258667995","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372025261125025","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c393797b-6c32-40a3-bde3-116199dd5d59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cb4bced7-f68d-4180-a77f-b0a4479e1f5a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dba7c911-d175-4859-8364-4ee5ec0527c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.081072692395929
Encrypted:	false
SSDEEP:	96:sVmqltJ10b9c9cicglX5nu3YwsY5Th6Cp9/x+6M8muecmAeC1e4zvrJ2X6gE5Aty:sVmeJQhglt4YwsYPpj+FVARJFBf
MD5:	67E769F11B981FED28A1F79422FB01FC
SHA1:	A1DA72CECB9B9AE26E375EDB8DACDF39558726DE
SHA-256:	34B14CD2821140DCD1FFD2C0F21D68DD0E6B4FF9F2B56AF07D53E1E6A6F58A91
SHA-512:	DD8AC104C0F2DF787727A12757865DA36FD3CC8092E0ED8F21CAD0F9E17D18DF937E90F25A89E12BB7C5D2D141145C7BE503410AD8F562C0007B93B28D3BBF6F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369433255229522","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3951d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.081072692395929
Encrypted:	false
SSDEEP:	96:sVmqltJ10b9c9cicglX5nu3YwsY5Th6Cp9/x+6M8muecmAeC1e4zvrJ2X6gE5Aty:sVmeJQhglt4YwsYPpj+FVARJFBf
MD5:	67E769F11B981FED28A1F79422FB01FC
SHA1:	A1DA72CECB9B9AE26E375EDB8DACDF39558726DE
SHA-256:	34B14CD2821140DCD1FFD2C0F21D68DD0E6B4FF9F2B56AF07D53E1E6A6F58A91
SHA-512:	DD8AC104C0F2DF787727A12757865DA36FD3CC8092E0ED8F21CAD0F9E17D18DF937E90F25A89E12BB7C5D2D141145C7BE503410AD8F562C0007B93B28D3BBF6F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369433255229522","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42334.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.081072692395929
Encrypted:	false
SSDEEP:	96:sVmqltJ10b9c9cicglX5nu3YwsY5Th6Cp9/x+6M8muecmAeC1e4zvrJ2X6gE5Aty:sVmeJQhglt4YwsYPpj+FVARJFBf
MD5:	67E769F11B981FED28A1F79422FB01FC
SHA1:	A1DA72CECB9B9AE26E375EDB8DACDF39558726DE
SHA-256:	34B14CD2821140DCD1FFD2C0F21D68DD0E6B4FF9F2B56AF07D53E1E6A6F58A91
SHA-512:	DD8AC104C0F2DF787727A12757865DA36FD3CC8092E0ED8F21CAD0F9E17D18DF937E90F25A89E12BB7C5D2D141145C7BE503410AD8F562C0007B93B28D3BBF6F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369433255229522","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557252165833772
Encrypted:	false
SSDEEP:	768:Bsdx92e7pLGLvNoWP4+fLy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVf2rgsrwzpBtur:Bsdx92ecvNoWP4+fLyu1jaG2gFHto
MD5:	0D34452B027FAC8894EEA05CAD1138D4
SHA1:	FEE139A212743C88922CFB2C30B43A7696195B50
SHA-256:	2202D6E0FF4662CB50F45F4BAC1733805701D95DBD44550AD9966B9E492C2E96
SHA-512:	415916E4A02CE90416C2E895413739452527E90B941F8146459D6FD4FCA00FAD0171C9991FEE43673A2BC466017C17232482A57680E1702142A8342B4ADC1ECC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369433255010814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369433255010814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF37996.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557252165833772
Encrypted:	false
SSDEEP:	768:Bsdx92e7pLGLvNoWP4+fLy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVf2rgsrwzpBtur:Bsdx92ecvNoWP4+fLyu1jaG2gFHto
MD5:	0D34452B027FAC8894EEA05CAD1138D4
SHA1:	FEE139A212743C88922CFB2C30B43A7696195B50
SHA-256:	2202D6E0FF4662CB50F45F4BAC1733805701D95DBD44550AD9966B9E492C2E96
SHA-512:	415916E4A02CE90416C2E895413739452527E90B941F8146459D6FD4FCA00FAD0171C9991FEE43673A2BC466017C17232482A57680E1702142A8342B4ADC1ECC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369433255010814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369433255010814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.195668519596602
Encrypted:	false
SSDEEP:	6:N5y/q2Pwkn23oH+TcwtrQMxIFUt885yVZmw+85y8tvkwOwkn23oH+TcwtrQMFLJ:Nk/vYfYebCFUt88kV/+8k8tv5JfYebtJ
MD5:	8C5D4454D364010E665A0BF0105138A1
SHA1:	E7D3B42FA3A146332A53B90ADE459811BC517AF2
SHA-256:	FB3B7B5B89E10678A1E53D203B086212950FF7F1F54C3B5C5CE61D9102C84560
SHA-512:	C082D7F1B0B4826BCB4D461668A6058765D0E0675F15B5396BF3ED85499A015CA3D7193161C835D43A1F125858B4481DEBAF6964F49473975B5A66B071F108AD
Malicious:	false
Preview:	2024/08/29-15:27:51.368 2224 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/29-15:27:51.369 2224 Recovering log #3.2024/08/29-15:27:51.373 2224 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.195668519596602
Encrypted:	false
SSDEEP:	6:N5y/q2Pwkn23oH+TcwtrQMxIFUt885yVZmw+85y8tvkwOwkn23oH+TcwtrQMFLJ:Nk/vYfYebCFUt88kV/+8k8tv5JfYebtJ
MD5:	8C5D4454D364010E665A0BF0105138A1
SHA1:	E7D3B42FA3A146332A53B90ADE459811BC517AF2
SHA-256:	FB3B7B5B89E10678A1E53D203B086212950FF7F1F54C3B5C5CE61D9102C84560
SHA-512:	C082D7F1B0B4826BCB4D461668A6058765D0E0675F15B5396BF3ED85499A015CA3D7193161C835D43A1F125858B4481DEBAF6964F49473975B5A66B071F108AD
Malicious:	false
Preview:	2024/08/29-15:27:51.368 2224 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/29-15:27:51.369 2224 Recovering log #3.2024/08/29-15:27:51.373 2224 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.162401739958384
Encrypted:	false
SSDEEP:	6:N58lN4q2Pwkn23oH+Tcwt7Uh2ghZIFUt8858EJZmw+858EDkwOwkn23oH+Tcwt7w:N0OvYfYebIhHh2FUt88T/+8J5JfYebIT
MD5:	7D1C9592E04998917F69B854F54F4DB3
SHA1:	6D1B1E77ADDD522F0FAB9BEF7A7DD1CCE2DDCEE7
SHA-256:	0E2226F802024D01F9364170B6644003ED8573522C96383333E8169D7FA74D52
SHA-512:	3644A3D20D87D1D757F1AC38F87533D2C9F34C5B07AA33BE50437D17D4E94D51DF9418C3903D067F9F810CB54F7D2475ACCEDE4516906C70F89A725C5504255F
Malicious:	false
Preview:	2024/08/29-15:27:35.008 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/29-15:27:35.009 1e04 Recovering log #3.2024/08/29-15:27:35.009 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.162401739958384
Encrypted:	false
SSDEEP:	6:N58lN4q2Pwkn23oH+Tcwt7Uh2ghZIFUt8858EJZmw+858EDkwOwkn23oH+Tcwt7w:N0OvYfYebIhHh2FUt88T/+8J5JfYebIT
MD5:	7D1C9592E04998917F69B854F54F4DB3
SHA1:	6D1B1E77ADDD522F0FAB9BEF7A7DD1CCE2DDCEE7
SHA-256:	0E2226F802024D01F9364170B6644003ED8573522C96383333E8169D7FA74D52
SHA-512:	3644A3D20D87D1D757F1AC38F87533D2C9F34C5B07AA33BE50437D17D4E94D51DF9418C3903D067F9F810CB54F7D2475ACCEDE4516906C70F89A725C5504255F
Malicious:	false
Preview:	2024/08/29-15:27:35.008 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/29-15:27:35.009 1e04 Recovering log #3.2024/08/29-15:27:35.009 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulNIa+:Ls1
MD5:	C6500C05953F8F1761611DC46B61BD1C
SHA1:	71ABD5D7DF626B3A90577217030D1A301FD66DCA
SHA-256:	D950BAFCD0D856BACF5C63F460EDEBCA06711FA73AF46658064B6FD787E1DFAC
SHA-512:	E7FDFE4CBD98091698C52E294FADE5B76E076194222016304D79529375D0C58814DF709CCA086DBF8F478B70A786FB56C6982E7B87461D87CDE56323E6787F72
Malicious:	false
Preview:	........................................x.X.m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlT:Ls3
MD5:	19AF74E38C8C11DC3752A7228C75BFCF
SHA1:	C79211B91D41366719CA0FF98D5F84E21897570F
SHA-256:	027671ACD6EAA046FAB16547C20282477C8F19ED84FD60CF9A4C72C4BE18FEA3
SHA-512:	240338E221EA80C0B1D236008BCEC4659EFE2BC938B8F7741092960454D25350A7327F9A09837C1D6A75C524BA78A479895D995E38A21CA08048AB002320F453
Malicious:	false
Preview:	............................................m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.293104420603815
Encrypted:	false
SSDEEP:	12:NJvYfYebvqBQFUt88P/+8H5JfYebvqBvJ:N1YfYebvZg88VZJfYebvk
MD5:	B824E0D539734006F525EB7ADE97741C
SHA1:	677F3A26B5E275C38B53F9535A2382CB357986D0
SHA-256:	DA065113CEEDCF1B47EB3A9A7EF38B363891EA499E8CC3DEA77394E8A9408D75
SHA-512:	9B142A8E866A70201569C5B98D25029A740C4D7FFE9F08A39834ACD328B3944C87CAA64EBFCF9BEEDEF3FF4DDFCD7EF97B3E9D474D9C75DD1A79421F504D14CB
Malicious:	false
Preview:	2024/08/29-15:27:36.379 2224 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/29-15:27:36.381 2224 Recovering log #3.2024/08/29-15:27:36.390 2224 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.293104420603815
Encrypted:	false
SSDEEP:	12:NJvYfYebvqBQFUt88P/+8H5JfYebvqBvJ:N1YfYebvZg88VZJfYebvk
MD5:	B824E0D539734006F525EB7ADE97741C
SHA1:	677F3A26B5E275C38B53F9535A2382CB357986D0
SHA-256:	DA065113CEEDCF1B47EB3A9A7EF38B363891EA499E8CC3DEA77394E8A9408D75
SHA-512:	9B142A8E866A70201569C5B98D25029A740C4D7FFE9F08A39834ACD328B3944C87CAA64EBFCF9BEEDEF3FF4DDFCD7EF97B3E9D474D9C75DD1A79421F504D14CB
Malicious:	false
Preview:	2024/08/29-15:27:36.379 2224 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/29-15:27:36.381 2224 Recovering log #3.2024/08/29-15:27:36.390 2224 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\52b9679f-1b48-4681-ab3d-7cae8a9db777.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRKXk1Yn:YH/u2caq3QH7E4TX
MD5:	1192DD11B1F5F8724DA374B0366A428E
SHA1:	CB40812A40613465E160C478DDF991C0AAA00731
SHA-256:	8E9C85442D198CE1085D98E21111320C07C08869CDD11853AF32FDFE8B2FDC58
SHA-512:	B7F100EA4668A801CA3BE81F38615E66EC871A8E093742D9B9673A278094508EA7099B6799EEF5D9C8FC5BB9CF72E52AC638EF93BBE14CB860E008BDBCA6FA32
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7e37e33a-d604-4e5c-bf4c-d778b5ccadc2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8b8fd8f3-41f3-4c55-a32d-4cabe16bf8ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF39338.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF43c59.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF324fe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d3df15ac-b452-48b2-a818-56702c47654d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f3904f5b-3009-4c4b-84d8-1173070d40cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.284207742908408
Encrypted:	false
SSDEEP:	12:NkjXMvYfYebvqBZFUt88kO/+8kR5JfYebvqBaJ:NAX2YfYebvyg887aJfYebvL
MD5:	092B21298F9F8096B2AC1D2859D74997
SHA1:	7D4685A0C29DAD5599F188B61785C70DE7288A14
SHA-256:	8254E22A8B089E81359508B9D35F46AC153ECA5982243E27CB139D749B3504D8
SHA-512:	8D35F624B856B0BA7C88E272B1AAF55BEC6D6C3DB484E249391E0B212CB801FBE79211E3F5F968001C72CA086B3ED59A583A596A4039158728170211D889A138
Malicious:	false
Preview:	2024/08/29-15:27:51.619 2224 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/29-15:27:51.621 2224 Recovering log #3.2024/08/29-15:27:51.631 2224 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.284207742908408
Encrypted:	false
SSDEEP:	12:NkjXMvYfYebvqBZFUt88kO/+8kR5JfYebvqBaJ:NAX2YfYebvyg887aJfYebvL
MD5:	092B21298F9F8096B2AC1D2859D74997
SHA1:	7D4685A0C29DAD5599F188B61785C70DE7288A14
SHA-256:	8254E22A8B089E81359508B9D35F46AC153ECA5982243E27CB139D749B3504D8
SHA-512:	8D35F624B856B0BA7C88E272B1AAF55BEC6D6C3DB484E249391E0B212CB801FBE79211E3F5F968001C72CA086B3ED59A583A596A4039158728170211D889A138
Malicious:	false
Preview:	2024/08/29-15:27:51.619 2224 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/29-15:27:51.621 2224 Recovering log #3.2024/08/29-15:27:51.631 2224 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.232325902638437
Encrypted:	false
SSDEEP:	6:N5F2F34q2Pwkn23oH+TcwtpIFUt885F93JZmw+85FIDkwOwkn23oH+Tcwta/WLJ:N7vYfYebmFUt88lZ/+8O5JfYebaUJ
MD5:	508BF33839787B3192A70F458900966D
SHA1:	A367136A5A5A9FD5CB29AB6D560ED1A599A7BE97
SHA-256:	6B6524D5A47994997A0786E157FD9A233FC111DD916F876D8A4E8479656D189B
SHA-512:	FB05F1DE68FEAC363E8D4D93035435C5533B36E6F80CB5EB061839AEEAF90759E7420C49AE362A47A7ACDBC43CE2002A74DAA49BF6DEA2051B70F622A3E827CB
Malicious:	false
Preview:	2024/08/29-15:27:35.110 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/29-15:27:35.117 1e04 Recovering log #3.2024/08/29-15:27:35.114 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.232325902638437
Encrypted:	false
SSDEEP:	6:N5F2F34q2Pwkn23oH+TcwtpIFUt885F93JZmw+85FIDkwOwkn23oH+Tcwta/WLJ:N7vYfYebmFUt88lZ/+8O5JfYebaUJ
MD5:	508BF33839787B3192A70F458900966D
SHA1:	A367136A5A5A9FD5CB29AB6D560ED1A599A7BE97
SHA-256:	6B6524D5A47994997A0786E157FD9A233FC111DD916F876D8A4E8479656D189B
SHA-512:	FB05F1DE68FEAC363E8D4D93035435C5533B36E6F80CB5EB061839AEEAF90759E7420C49AE362A47A7ACDBC43CE2002A74DAA49BF6DEA2051B70F622A3E827CB
Malicious:	false
Preview:	2024/08/29-15:27:35.110 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/29-15:27:35.117 1e04 Recovering log #3.2024/08/29-15:27:35.114 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:8/C/l1lhtlW:8/E3G
MD5:	68E2D0983474C0D1599C8E9FF6845C1D
SHA1:	C5CDEC02D980267864B635130C2809BD18A56E16
SHA-256:	F6D312817715BF28C67DCECC1FE6A4839ACC4DCEEE600732656182A3DF18F8E5
SHA-512:	C8E0A855155D1933C87AA2E129CC8A632FC3190EF4B5FEE6A2E777735ADDAC691CEF8B60972C7BB0D8B5BF860B28A3F9E4541EAA0AA03764F0CE244A735263FB
Malicious:	false
Preview:	.............S.~...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\df0b9425-b6cd-4f2f-aea3-f5f23e1e05bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ee0ca54f-25ad-4249-bc05-2d197431a493.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.081072692395929
Encrypted:	false
SSDEEP:	96:sVmqltJ10b9c9cicglX5nu3YwsY5Th6Cp9/x+6M8muecmAeC1e4zvrJ2X6gE5Aty:sVmeJQhglt4YwsYPpj+FVARJFBf
MD5:	67E769F11B981FED28A1F79422FB01FC
SHA1:	A1DA72CECB9B9AE26E375EDB8DACDF39558726DE
SHA-256:	34B14CD2821140DCD1FFD2C0F21D68DD0E6B4FF9F2B56AF07D53E1E6A6F58A91
SHA-512:	DD8AC104C0F2DF787727A12757865DA36FD3CC8092E0ED8F21CAD0F9E17D18DF937E90F25A89E12BB7C5D2D141145C7BE503410AD8F562C0007B93B28D3BBF6F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369433255229522","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ee564e57-beb5-437d-aceb-9b53f39cc8fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9332
Entropy (8bit):	5.188023099890876
Encrypted:	false
SSDEEP:	96:sVmqltJ10b9c9cicglX5nuxV4o7YwsY5Th6Cp9/x+6M8muecmAeC0Re4zvrJ2X6p:sVmeJQhglti4o7YwsYPpj+FVAuJFBf
MD5:	CFD99EDD6C342C05539C5923B2CEA2F1
SHA1:	23AC12090CA475CE6374976901C9728B15D52D55
SHA-256:	B65C1F9186DE6D1C7CDD0AEF6CC57A6D1DD3A7FEA20D0BD0B7881DBBA78C612A
SHA-512:	D410262550BE10AF96F9135319C400F88E27F1CE641E4711F61630BB3479AF8E83D27CF153BDA2C645F945C53DFF062CC02687925BAAC1AB6AA9BC0F0598C4EF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369433255229522","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.304843117213832
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQuilvl/l3seGKT9rcQ6xd0NdpOtlTxotl:/XntM+RGFl3sedhOCdOu
MD5:	5EE097DFD46AEBB47EF1484BD71A44A1
SHA1:	C52228882CA609AFD037663757BADDD233E372F8
SHA-256:	181D6CB85E3745896CAEE13CDA58A8311342C560C65A7B829C52012B6C6CF34C
SHA-512:	AA7E94B53ED5EA837337B0E39E5AB34BEE376542B3EDE94AE0C5710DE871482839243A75D67E19E1C36750B8708A2DAE5C1331F1395E1D80E06C6862B78555AA
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.(X!0................39_config..........6.....n ....1u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.256242643957091
Encrypted:	false
SSDEEP:	6:N5Hkj+RM1wkn23oH+Tcwtfrl2KLlL5Hv/34q2Pwkn23oH+TcwtfrK+IFUv:Nto+RrfYeb1L1tv/IvYfYeb23FUv
MD5:	E2DA27CD0259B82E131AC364B6A64459
SHA1:	B929AA1E884B3513289A6D9B086255377D6F762C
SHA-256:	76C3D6EFBC651D048E2A4466F63FE592234F2E213A32638CFEEF6B8AC5C97FB2
SHA-512:	26BB7151783294005577438DE705309F7DD36F2C3FC2D58B5035804D1F99501031DFEE72F6E99CC0E09E87E96FEC2CE432C71B342CFADC71FC1FF55F6FED6CB0
Malicious:	false
Preview:	2024/08/29-15:27:35.327 1e04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/29-15:27:35.337 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9275169283101077
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PEWXZi+5uh/2Rdj0QWQ0:G0nYUtPrPJ6B/XMtzNP9i+4hORdZx0
MD5:	A21ADD072F290BB8025555CE1EF9014C
SHA1:	BC07D222EF610DCE637F72866D14D7560926EB5C
SHA-256:	1D64B6F3EBA3FC479C8A8A34AB1D17D263E71AC35707450E323DA7E482E48195
SHA-512:	164C693EE34EE72E4401DFF69B7E4CFE2BA100E7F3C8D2665B91BFC200011F808FEF9EB878656CE54478EF7F6B814EAD722C4EDC74F7300BA5E1B696F6CA1CCF
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.........................20_..........................19_.....}....................18_......m=.................37_.....uTN..................38_.......h.................39_........I.................21_......j...................21_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.205582468102581
Encrypted:	false
SSDEEP:	6:N5rRM1wkn23oH+Tcwtfrzs52KLlL5HcAVj34q2Pwkn23oH+TcwtfrzAdIFUv:NpRrfYebs9L1tcVvYfYeb9FUv
MD5:	CE25A5B3FFFC11DD94F8197D2EEE8FAD
SHA1:	474ED2A571CEC485BD672F82B2599C8590F99803
SHA-256:	8F00B361611CC7C1F68B57FBC17F0659A547B9FD88672B8F36256381F5F5A29A
SHA-512:	0045E0D2C927F673D36E878545CF0ED2B462F8A5945A51E98DD95C2E37656A9CB3D055D1369DA9D7C7206232C566A6A405D1D1A4B9B28ED44E4F3590020C0CDD
Malicious:	false
Preview:	2024/08/29-15:27:35.299 1e04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/29-15:27:35.320 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlHl:Ls3
MD5:	F4270F31623EF41296C8033589294754
SHA1:	53897A7BE447A0FB9E75B150CEE7C0A9DE2010BC
SHA-256:	12D36DB08345347BBFF9524A0E265729BE52A591021937EBF194A7AD94E9A262
SHA-512:	3805CDA4DAFFB98BA2C3B2BCAF061D95E5031029D7473AE77D1008DE23ECC6118B170142A23D67B0C96A1918C719F5D7091A5C01EB0FFACBF308A7C8D06A4253
Malicious:	false
Preview:	............................................m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl:Ls3
MD5:	84AC5D8CAD6FCC6725840AF2B3ED9821
SHA1:	75FE6B34F3A571EA457A31AB667B0C039F103655
SHA-256:	BBBF1E2F55E524828DEC178968096756133366A07729F6CCB198B617797D0605
SHA-512:	43E404E1B59572799A1DAA6CFED6CDCEE2DB0A3193705ACF3057EC68A0472E9AD3991A2499B28C5EBFE1CBBF1F90303CF1084D3A955547AD7AD61BC90BA09E62
Malicious:	false
Preview:	........................................C...m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF311b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31222.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33307.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33317.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33346.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33356.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35322.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35341.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38742.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38790.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3fbc6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF422d6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF472da.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790252689350088
Encrypted:	false
SSDEEP:	192:akkp+ZY1CseiRUvhuW6qRAq1k8SPxVLZ7VTiq:akQxz296q3QxVNZTiq
MD5:	740B72ACA41E3970CFE86B972E1CADC8
SHA1:	CAF91C28FAB3FC293D1BF7BD149F431FAA290845
SHA-256:	FC882FFAA5A0D00732E21CF8BBF322566FD9C56E3889D711F7C81D1B5009CF50
SHA-512:	7A1FD1ED64BF72315A3914C3AAA2F8B17FD3B51587AF16AEE3A7B6D0919F86D5679AA768E5E0044544550FB33DE998850AC77A1FF5188BFBFB0ACC707C61FA85
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1afpTN7IPRYl+uFYQMnsTEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADjSdZQfwNxqlBQ4PH3gsdJzWN2iemOplPP7saEJ2ByugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl5SBl:Ls3u
MD5:	DD0BAA296B4CF5855159BBA59BFBD0AE
SHA1:	52A85707FB538D4ADAC8121833FB4B7F6FF56944
SHA-256:	721CC992B91315277E44BF64461E6C11679D3356C3297353BA59FF23A3B5D162
SHA-512:	D982334405D8B82E4422F91844F3A142DA2FEB82BC42E81EE8DB3FD788DFF002DEA248DCEB348FC63EBA4B80CDB7DC198971A321079D7D513661302748694A1B
Malicious:	false
Preview:	............................................m./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a542b1dc-6191-40ba-a0a2-5b1b73c25e66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.831233809946089
Encrypted:	false
SSDEEP:	192:fsNwkp+ZY1CeeiRUuye12Q5fI1wlkKy96qRAq1k8SPxVLZ7VTiB:fsNwQx5PyWF5fww2Ky96q3QxVNZTiB
MD5:	432388C37F9B3127B6842FD25912AEA9
SHA1:	01D8253FEBD2CA96B2623D14D9A834F016742920
SHA-256:	CB8B2FB378AD4378CDD1930C80DB85BE25C29961D0750DE2508F1C5BD83602FD
SHA-512:	A36C1206DC3CDF950B6E5F8C0F084F498359AAB80F11F75F2705D4CE8423D7E311D02A425D9668E5FB654AEFF2306C07BC747284AC6799BB6E24587F79EA8A8F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ad7d9b51-d1c6-486d-ac15-e6cc2b01cda3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.831118924135829
Encrypted:	false
SSDEEP:	192:fsNwkp+ZY1CeeiRUuye12Q5flyzkKy96qRAq1k8SPxVLZ7VTiB:fsNwQx5PyWF5f4wKy96q3QxVNZTiB
MD5:	EDB28FA43F623046A475D7A87CA0A968
SHA1:	48422CBBC3A63CA5B3DD466A642E93F689B01427
SHA-256:	F64ADD31FDF77BBD5CB8A1BEBE86AD893BC99A250286275D6B9FD50563FF0CD5
SHA-512:	61F400B62A6DF4B4FC31DC06309972B8B58885298B9FF5197D1F0DF2CDC9F2284F57AC8FD14FD28A7CB1AC019BFBAD0E001A123155ED3F61BF167E876358B29C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cd6b8568-80c7-4ffe-9624-fe7b05e3c8e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.831134176497583
Encrypted:	false
SSDEEP:	192:fsNwkp+ZY1CeeiRUuye12Q5fWjrkKy96qRAq1k8SPxVLZ7VTiB:fsNwQx5PyWF5fMoKy96q3QxVNZTiB
MD5:	B4A3D15FDD31F22F6C9D917DD06B0355
SHA1:	E64B182780650A0E1A376CED292CBA928D309F4D
SHA-256:	D5BD64ADC31C8678B5F187B376D80C948A39D380949E7704A99CC8ED0BCDD92C
SHA-512:	C8445650C79636DE4304DD8F0352CC67EDCCB8AC9E17C58F04D45A3A56D0431AE8E7B8C924A8F14BEE78263C4873D002D4680B26EB3AC3935BDFDD04CF3F4343
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d9e6ac28-b0ad-49a3-95bf-92868ebafe5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.797639275408954
Encrypted:	false
SSDEEP:	192:fsNwkp+ZY1CeeiRUuyxQuXkKr6qRAq1k8SPxVLZ7VTiQ:fsNwQx5PyOlKr6q3QxVNZTiQ
MD5:	6A0CD58B3D629C0A834798C69B1C7389
SHA1:	E16C4FE70E451F6F10F615992C06286F22493D92
SHA-256:	C139200B65279ED26EB4045C0DEBFD750DFF3950F221476C3E47C4106761B2AD
SHA-512:	4007A6EA20BFBF609A50B2D579B2BBA23A1687D07A625D74A899394048861B13762EFECD290DD9087FF1DFD8249F1EF8E45549FD74133E24A8981205D0C79601
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e4d8c6ab-cf3c-4df0-ae38-1c295bb0531b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46882
Entropy (8bit):	6.081693813182886
Encrypted:	false
SSDEEP:	768:3MGQ7FCYXGIgtDAWtJ4nri4JhDkAdMfP7cr8BrZ6yyOouYg8TC5z7nh02tdu:3MGQ5XMBGmV7G8J9ljZ5zF2
MD5:	C498CC1E4A381D3D8AE3B79BBB4CFADE
SHA1:	98A8518B6B3F642D8349067526D12E3CD44EC0A2
SHA-256:	99B95D9826B23CEC802F347C66FCF3E0897D8A9D115AF08A3D1BD9ACE758B666
SHA-512:	2BADD12F5B313EB48408A3C0ACFAA09C4FA2D9E1A0821D2476CF2449BDC188BE14871C09492A706A55471779CCBE6FB97F9FC0681A29B34102899C72866B9821
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433255277069","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f050c82f-3d2f-48d3-9e77-4b0eeb66bf06.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.058615429374029
Encrypted:	false
SSDEEP:	384:9tMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwOx6h4slKy+Mh0lkdHd5qJ:3MGQ7FCYXGIgtDAWtJ4ngi4slK6h02to
MD5:	C234700C8E3366BC5F476A42B7432477
SHA1:	7292D8AF5D1F76109ECBB9734A4AE25F9CCC9548
SHA-256:	50FBD34632D08EBEF865212B7C3C65379C5988FFA7EE32B7E3B9E114BAFD8F18
SHA-512:	FF63D43E5779AF6D535156ECC206382378A3F67977655085D77AB3C0E3BDA2DA99E912D6FF3CE14507EDC6334EBAA31D6A4CD81C1359D7163C9A8F49B3C7DA59
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369433255277069","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8501460398008565
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxRxl9Il8usZP93GwY55YS0Sr1FMRx+1zeHmPOkd1rc:mUYGZPtGwYo+EY1zeH2Oj
MD5:	59D287EE7AB399A0A786A94AD865E858
SHA1:	CF630EA3908B1FFA1D509FAC60473DCAAB9B6122
SHA-256:	92E2AE8356C00BA88D435FEA32D4C63A832B5955DE74D1F36407808AB09A332F
SHA-512:	B160C63AF949D80319A5367731755FAA8ACED698525E12A8FA81C7D0A1EFBF800323791DF20429E9DF739D1F5944F8FA633603AB8C4C0E7DCB1442F6765E346A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.C.1.b.2.F.H.6.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.W.n.6.U.z.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9998701530597387
Encrypted:	false
SSDEEP:	96:v7YGZT79uQ4TWYeeCAgbAPeBGgZwk8ltl8rjP+YG8:v7P7kQZBAaIgKdltl8rjmYH
MD5:	55B7F1835337E5BCB0A0ABA17822E5A9
SHA1:	92F34C29955BB4828599F2BB958B774306C3525F
SHA-256:	FAE47720F8B02557A3F1A38A637CC1033059DC3816FA8E1B6D394226B5E09C05
SHA-512:	56C7056B6C024FFF6C2AB6A81871E093798B5B68005F398F72FF93494F8CC02547CB7F13971EA436FA7F318A47BD7E7B22D41482EFA1858362F37262D17C8495
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".8.Q.k.v.v.k.n.6.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.W.n.6.U.z.

C:\Users\user\AppData\Local\Temp\1f61b11e-52da-4f34-aa08-fa463e42d726.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\3dabdf7b-27d7-4187-bc59-b8e7b10edcde.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\9945c1c9-d94f-4f66-9384-306bde3e1edf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c9fa7980-3fb7-418a-aafc-30fdc71f0dd5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.3491714171178515
Encrypted:	false
SSDEEP:	12:YXXktvqTL0Dkv/hxVn2ZLL56s/hxV+cSL0Dkv/hxVdL56s/C:YHktQL00Vn2ZLL5JV+cSL00VdL5M
MD5:	AF3BBF19DD901778F57A87EA4E9F2F35
SHA1:	687A2CAE98090149E011A99E2BC24DA4D69F11EF
SHA-256:	E530DDF771B6503AF9BA039A0BB48317A7E0337772ABA18DC51286708B967472
SHA-512:	31E6CBEEEE38B6D5E8F8B94EDC3C0098AA1F7A4AADABEB728C85D47A8CAB62AE5B3157B5B31E4516CF90F863AD1ABA53BF489E28050F363A221814EFEEBB0FA9
Malicious:	false
Preview:	{"logTime": "0829/192721", "correlationVector":"81C9BB71E1B64E95BA81C729ED90A1A8","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0829/192737", "correlationVector":"X+UICsmLJn2fE/QmWevm58","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0829/192737", "correlationVector":"DFDBC4E01A6E41029E7ED4643543B43D","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0829/192737", "correlationVector":"xqNstlXKEeAb07QJRLVctD","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\scoped_dir9164_2023083186\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir9164_2023083186\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9164_2023083186\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9164_2023083186\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_2023083186\c9fa7980-3fb7-418a-aafc-30fdc71f0dd5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\3dabdf7b-27d7-4187-bc59-b8e7b10edcde.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir9164_276864945\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5129965447522595
Encrypted:	false
SSDEEP:	48:IEJMdOvc+YsJNrczBdLXuHOkDpC2A3BjdOvcIYsJNrczngdLXuHOk+21:A3uukD5ynIuukz
MD5:	216F5271916E01CA4652B2E233EA849A
SHA1:	8D53087BD8AD07C934B53A5BFF6197A57E98C20C
SHA-256:	51CC4BFD50B5BF9E642418342974C7ECB835AAE1C5927348F7DDEEC5B735D11D
SHA-512:	84DD9036FCE1FD75A28A99FCC51746921375E136544954AC17EC62F37DF0079B8C5CF779BDFF3ED96731390D9480AB9B5505437D4482FFAF5BAA47F2B389A093
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...h.pwI....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWW`..PROGRA~2.........O.IDWW`....................V.....Z+..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWV`..MICROS~1..D......(Ux..Yh...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Yh...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Yh.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........zD.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8FEJO46UCK37MFZJETBF.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5120863581175303
Encrypted:	false
SSDEEP:	48:IE3BjdOvcIYsJNrczBdLXuHOkDpC2A3BjdOvcIYsJNrczngdLXuHOk+21:r3uukD5ynIuukz
MD5:	8F042EFD889D60AED1486F5C27FC4FB8
SHA1:	EA923CEE1BACDC9A072D82065A064B86E72254A6
SHA-256:	3A76B87AF08B0BE8FCACF6B6E810C10953D4730185B2228C57F4B373C6980ACB
SHA-512:	8BDE8ED093308034BA7AC06C2DEE69CF2F8214E62BFE9BA0776C0FD21B6926A9FA7E8754B7F68657F8BC8E52D9438958054C9DFB272B64DEECB78AA572F1F44C
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...h.pwI....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Yf...PROGRA~2.........O.I.Yf.....................V........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWV`..MICROS~1..D......(Ux..Yh...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Yk............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Yh...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Yh.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........zD.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MN205FNN4CAEQTUAYPEU.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5129965447522595
Encrypted:	false
SSDEEP:	48:IEJMdOvc+YsJNrczBdLXuHOkDpC2A3BjdOvcIYsJNrczngdLXuHOk+21:A3uukD5ynIuukz
MD5:	216F5271916E01CA4652B2E233EA849A
SHA1:	8D53087BD8AD07C934B53A5BFF6197A57E98C20C
SHA-256:	51CC4BFD50B5BF9E642418342974C7ECB835AAE1C5927348F7DDEEC5B735D11D
SHA-512:	84DD9036FCE1FD75A28A99FCC51746921375E136544954AC17EC62F37DF0079B8C5CF779BDFF3ED96731390D9480AB9B5505437D4482FFAF5BAA47F2B389A093
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...h.pwI....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWW`..PROGRA~2.........O.IDWW`....................V.....Z+..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWV`..MICROS~1..D......(Ux..Yh...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Yh...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Yh.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........zD.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5120863581175303
Encrypted:	false
SSDEEP:	48:IE3BjdOvcIYsJNrczBdLXuHOkDpC2A3BjdOvcIYsJNrczngdLXuHOk+21:r3uukD5ynIuukz
MD5:	8F042EFD889D60AED1486F5C27FC4FB8
SHA1:	EA923CEE1BACDC9A072D82065A064B86E72254A6
SHA-256:	3A76B87AF08B0BE8FCACF6B6E810C10953D4730185B2228C57F4B373C6980ACB
SHA-512:	8BDE8ED093308034BA7AC06C2DEE69CF2F8214E62BFE9BA0776C0FD21B6926A9FA7E8754B7F68657F8BC8E52D9438958054C9DFB272B64DEECB78AA572F1F44C
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...h.pwI....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Yf...PROGRA~2.........O.I.Yf.....................V........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWV`..MICROS~1..D......(Ux..Yh...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Yk............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Yh...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Yh.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........zD.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.57975988524553
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	21ba5e866bfd9eb0051f4d3648713c62
SHA1:	ef4b86c59b78ec4862f204d379b51f00948196a0
SHA256:	549fb617ae94c424ffd4f26fc3baba95dfce69cd5af791da698e0bfa59a50bff
SHA512:	af412fdfd59fe6483a509067d95bdf446216ea50fe5c07c5d9a52b4c216abd689235f94366b9945fa054588e5efa4be9de7141e900820099fc2e5507e1f552de
SSDEEP:	12288:kqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTv:kqDEvCTbMWu7rQYlBQcBiT6rprG8asv
TLSH:	36159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D0C661 [Thu Aug 29 19:05:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FDEC5152013h
jmp 00007FDEC515191Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FDEC5151AFDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FDEC5151ACAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FDEC51546BDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FDEC5154708h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FDEC51546F1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	fd6b5c84820c784679edaa68ddb18a9e	False	0.286953125	data	5.165947748525917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 21:27:15.790009022 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 29, 2024 21:27:22.095555067 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.095590115 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.095807076 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.095985889 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.096002102 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.669929981 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.669965029 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.670108080 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.670428038 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.670442104 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.768799067 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.769047976 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.769062042 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.770039082 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.770315886 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.771086931 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.771147966 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.771326065 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.771332979 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.826535940 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.876203060 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.876219988 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.876226902 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.876251936 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.876262903 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.876275063 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.876292944 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.876310110 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.876342058 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.876435041 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.965051889 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.965066910 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.965110064 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.965126991 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.965162992 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.967405081 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.967418909 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.967463970 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.967472076 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:22.967494011 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:22.967503071 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.055897951 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.055923939 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.055959940 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.055970907 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.055996895 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.056020975 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.056277037 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.056328058 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.056329966 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.056370974 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.057987928 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.058013916 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.267935038 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.267961979 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.268013000 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.268337011 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.268345118 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.268390894 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.268696070 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.268722057 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.268939972 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.286725998 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.286741972 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.287250996 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.287264109 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.287462950 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.287473917 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.287833929 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.287848949 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.288472891 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.288625956 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.288639069 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.330224991 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.343044996 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.343080044 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.343965054 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.344029903 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.344404936 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.344464064 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.344635010 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.344643116 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.389260054 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.448704004 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.448726892 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.448734045 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.448755026 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.448765993 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.448777914 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.448786974 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.448793888 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.448832035 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.448945999 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.449004889 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.451791048 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.622350931 CEST	49750	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:23.622369051 CEST	443	49750	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:23.629318953 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.629343987 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.629457951 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.630049944 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.630064011 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.746490955 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.746782064 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.746793032 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.747765064 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.747823954 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.748668909 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.749051094 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.749116898 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.749339104 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.749350071 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.749428034 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.749443054 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.750396013 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.750444889 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.751349926 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.751408100 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.751477957 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.751483917 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.759653091 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.759804964 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.759813070 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.760786057 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.760840893 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.761663914 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.761723995 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.761811018 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.761831045 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.767602921 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.767774105 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.767796040 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.769140959 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.769186974 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.770742893 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.770824909 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.770987034 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.770994902 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.795744896 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.795746088 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.811346054 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.855211020 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.855268002 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.855331898 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.855473042 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.855487108 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.881999969 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.888825893 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.888880014 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.888937950 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.889082909 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.889094114 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.891482115 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.891540051 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.891671896 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.891803980 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.891815901 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.909020901 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.909071922 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:23.909183025 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.909233093 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:23.909239054 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.078186989 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.078260899 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.078324080 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.078500032 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.078521967 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.081073999 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.081279039 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.081290960 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.082129002 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.082222939 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.083146095 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.083203077 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.083391905 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.083400011 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.123888969 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.131366968 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:24.131402016 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:24.131495953 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:24.133469105 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:24.133486032 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:24.200200081 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.200246096 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.200304985 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.200670958 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.200687885 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.538108110 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.538294077 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.538315058 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.539402962 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.539462090 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.539747000 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.539822102 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.539865017 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.584496975 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.681667089 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.681725979 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.681936026 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:24.681950092 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:24.773180008 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:24.773257017 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:24.777187109 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:24.777194977 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:24.777401924 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:24.846282959 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:24.855890036 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:24.900496006 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:25.119890928 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:25.119959116 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:25.120079041 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:25.123837948 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:25.123837948 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:25.123848915 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:25.123859882 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:25.212527990 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:25.212563038 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:25.216778040 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:25.217869997 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:25.217889071 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:25.984414101 CEST	49764	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:25.984447002 CEST	443	49764	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:25.984532118 CEST	49764	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:25.984781981 CEST	49765	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:25.984812975 CEST	443	49765	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:25.984863997 CEST	49765	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:25.985101938 CEST	49764	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:25.985116005 CEST	443	49764	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:25.985310078 CEST	49765	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:25.985318899 CEST	443	49765	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.082909107 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:26.082972050 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:26.084647894 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:26.084661961 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:26.084865093 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:26.086215019 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:26.132498980 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:26.359957933 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:26.360003948 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:26.360057116 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:26.439493895 CEST	443	49765	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.439955950 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.439994097 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.440049887 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.440146923 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.440172911 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.440217972 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.440388918 CEST	49765	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.440407991 CEST	443	49765	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.440541029 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.440562010 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.440731049 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.440746069 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.440798044 CEST	443	49765	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.441179991 CEST	49765	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.441251993 CEST	443	49765	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.446202040 CEST	443	49764	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.446419001 CEST	49764	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.446432114 CEST	443	49764	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.446707964 CEST	443	49764	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.446966887 CEST	49764	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.447020054 CEST	443	49764	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.485021114 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:26.485040903 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:26.485054016 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 29, 2024 21:27:26.485059977 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 29, 2024 21:27:26.486852884 CEST	49765	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.530287027 CEST	49764	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.767766953 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:26.767802954 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:26.767859936 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:26.768430948 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:26.768446922 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:26.900026083 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.900294065 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.900310040 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.900440931 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.900630951 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.900697947 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.900825977 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.900845051 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.901163101 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.901215076 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.901217937 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.901285887 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.901758909 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.901803017 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.903006077 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.903067112 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.903171062 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.903225899 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.903464079 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.903471947 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.903953075 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:26.903960943 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:26.952843904 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.045789957 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.207957029 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.208009005 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.208022118 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.208082914 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.208125114 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.208501101 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.208998919 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.208998919 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.209016085 CEST	443	49766	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.210125923 CEST	49767	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.210154057 CEST	443	49767	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.210181952 CEST	49766	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.242635012 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.242974997 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:27.242990971 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.243839979 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.243969917 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:27.245213032 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:27.245213032 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:27.245228052 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.245275974 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.340989113 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.341031075 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.341085911 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.341106892 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:27.341114044 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.341125965 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:27.341125965 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.341181040 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:27.341562986 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.341598034 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.341851950 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:27.458812952 CEST	49768	443	192.168.2.4	142.250.64.68
Aug 29, 2024 21:27:27.458841085 CEST	443	49768	142.250.64.68	192.168.2.4
Aug 29, 2024 21:27:27.522382975 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.522423029 CEST	443	49769	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.522488117 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.597594023 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.597615004 CEST	443	49770	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.597984076 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.600692987 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.600713015 CEST	443	49769	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.611931086 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.611948967 CEST	443	49770	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.075134039 CEST	443	49769	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.083400011 CEST	443	49770	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.087646961 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.087663889 CEST	443	49769	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.087790966 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.087800026 CEST	443	49770	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.088152885 CEST	443	49770	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.088208914 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.088246107 CEST	443	49769	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.088294983 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.088836908 CEST	443	49770	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.088881016 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.089174032 CEST	443	49769	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.089221001 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.119338989 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.119406939 CEST	443	49770	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.120870113 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.120951891 CEST	443	49769	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.170656919 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.170665979 CEST	443	49770	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.170689106 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.170695066 CEST	443	49769	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.217542887 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.217628002 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.427277088 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:28.427311897 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:28.427370071 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:28.428550959 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:28.428565025 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:29.256594896 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:29.256715059 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:29.260523081 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:29.260533094 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:29.260792971 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:29.342343092 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:30.342204094 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:30.351397038 CEST	49723	80	192.168.2.4	2.19.126.137
Aug 29, 2024 21:27:30.356722116 CEST	80	49723	2.19.126.137	192.168.2.4
Aug 29, 2024 21:27:30.356770992 CEST	49723	80	192.168.2.4	2.19.126.137
Aug 29, 2024 21:27:30.384505987 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.611867905 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.611896992 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.611903906 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.611933947 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.611948013 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.611958981 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.611964941 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:30.611982107 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.612006903 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:30.612025023 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:30.612328053 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.612387896 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:30.612399101 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.612860918 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:30.612910986 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:31.661468029 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:31.661489010 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:31.661562920 CEST	49771	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:27:31.661570072 CEST	443	49771	40.68.123.157	192.168.2.4
Aug 29, 2024 21:27:38.725641012 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:38.725653887 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:38.725953102 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:38.726154089 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:38.726164103 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.343229055 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:39.343254089 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:39.343311071 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:39.343729019 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:39.343741894 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:39.444437027 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.444729090 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.444736958 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.445039988 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.445053101 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.445105076 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.445111036 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.445148945 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.445647001 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.446899891 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.446949959 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.447058916 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.488500118 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.602303028 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.602309942 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.705569029 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.716535091 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.716564894 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.716605902 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.716614008 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.716876984 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.716921091 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.716927052 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.721643925 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.721688986 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.721694946 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.727566004 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.727615118 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.727621078 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.733942032 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.734015942 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.734020948 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.740150928 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.740293980 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.740299940 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.746382952 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.746520042 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.746526003 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.752954960 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.753070116 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.753076077 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.803158045 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.803212881 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.803219080 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.806233883 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.806281090 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.806287050 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.813345909 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.813467979 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.813473940 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.817733049 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.817785025 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.817790031 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.824032068 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.824074984 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.824080944 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.830610037 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.830728054 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.830734015 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.836700916 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.836786032 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.836790085 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.842832088 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.842876911 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.842883110 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.848783970 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.848854065 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.848860025 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.854554892 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.854603052 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.854609966 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.860385895 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.860441923 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.860449076 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.865767002 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.866452932 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.866468906 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.871071100 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.871120930 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.871126890 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.876892090 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.876949072 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.876962900 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.882527113 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.882576942 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.882584095 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.889746904 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.889802933 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.889812946 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.891314983 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.891360998 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.891366959 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.895735025 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.895800114 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.895806074 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.899211884 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.899256945 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.899264097 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.903403044 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.903445959 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.903453112 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.906771898 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.906816959 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.906822920 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.910249949 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.910296917 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.910303116 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.914006948 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.914052963 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.914058924 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.917658091 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.917710066 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.917716980 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.921355963 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.921509027 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.921514988 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.925039053 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.925085068 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.925091028 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.928371906 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.928427935 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.928432941 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.931957006 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.932012081 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.932017088 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.935724020 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.935770988 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.935777903 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.939167976 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.939214945 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.939225912 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.943780899 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.943835974 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.943841934 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.946851015 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.946918011 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.946923018 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.949932098 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.950001955 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.950006962 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.953716993 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.953784943 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.953789949 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.957273960 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.958444118 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.958450079 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.960776091 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.960832119 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.960836887 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.965542078 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.965590954 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.965595961 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.969039917 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.969084024 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.969089031 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.973037004 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.973082066 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.973088026 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.973896027 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.973948956 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.973948956 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.973958015 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.974003077 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.978528023 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.981934071 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.981995106 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:39.982089996 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.982213020 CEST	49783	443	192.168.2.4	142.250.185.97
Aug 29, 2024 21:27:39.982224941 CEST	443	49783	142.250.185.97	192.168.2.4
Aug 29, 2024 21:27:40.010404110 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.010651112 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:40.010664940 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.011524916 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.011585951 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:40.012717962 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:40.012768030 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.013098001 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:40.060492039 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.107731104 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:40.107743979 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.118076086 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.118086100 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.118122101 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.118139982 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.118165016 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.118168116 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:40.118177891 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.118221045 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:40.118499994 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.118537903 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.118685961 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:40.119680882 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:40.119695902 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 29, 2024 21:27:40.119708061 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:40.119746923 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 29, 2024 21:27:41.351269960 CEST	443	49765	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:41.351360083 CEST	443	49765	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:41.351417065 CEST	49765	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:41.355680943 CEST	443	49764	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:41.355736017 CEST	443	49764	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:41.355801105 CEST	49764	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:41.771168947 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:41.771195889 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:41.771267891 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:41.771621943 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:41.771644115 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:41.771711111 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:41.772177935 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:41.772193909 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:41.772309065 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:41.772315979 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:41.877937078 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:41.877952099 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:41.878046989 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:41.878627062 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:41.878637075 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:42.225076914 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.225394964 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.225413084 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.226485968 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.226541996 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.227178097 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.227499962 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.227514029 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.227716923 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.227807999 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.227885962 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.228391886 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.228449106 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.229299068 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.229352951 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.229432106 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.229439020 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.272505999 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.280394077 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.280395031 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.280406952 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.327286959 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.350650072 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:42.350856066 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:42.350864887 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:42.351716042 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:42.351774931 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:42.352855921 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:42.352912903 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:42.353034019 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:42.353039026 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:42.356847048 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.356956959 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.357006073 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.357013941 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.357054949 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.357083082 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.357093096 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.357098103 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.357498884 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:42.357511044 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:42.405412912 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:42.484527111 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:42.484570980 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:42.484636068 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:42.484949112 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:42.484958887 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:56.924762011 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:56.924792051 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:56.925035954 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:56.925059080 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:56.925081968 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:56.925152063 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:56.925539017 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:56.925549984 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:56.925833941 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:56.925846100 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.621447086 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.621933937 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.621941090 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.622169971 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.622229099 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.622812033 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.622832060 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.623104095 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.623159885 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.623188972 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.624310970 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.624383926 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.686490059 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.686491013 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.747159958 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:57.747190952 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:57.747297049 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:57.747536898 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:57.747550964 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.331454992 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.353476048 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:58.353512049 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.354357958 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.354418993 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:58.355654955 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:58.355710030 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.355878115 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:58.396507025 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.407141924 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:58.407154083 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.453169107 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:58.455904007 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.456851006 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.456856966 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.456895113 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.456909895 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.456922054 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.456927061 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:58.456967115 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:58.457787991 CEST	49792	443	192.168.2.4	152.195.19.97
Aug 29, 2024 21:27:58.457799911 CEST	443	49792	152.195.19.97	192.168.2.4
Aug 29, 2024 21:27:58.678870916 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:58.678929090 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:58.679325104 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:58.679333925 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:58.679368019 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:58.679399014 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:58.679666996 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:58.679682970 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:58.679902077 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:58.679915905 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.137360096 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.191893101 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.210196018 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.210232019 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.210567951 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.214095116 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.214160919 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.256266117 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.371547937 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.371810913 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.371834040 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.372118950 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.372517109 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.372572899 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.420617104 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:28:08.104465961 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:08.104501009 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:08.104578972 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:08.104934931 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:08.104939938 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:08.899096012 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:08.899194002 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:08.903022051 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:08.903028965 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:08.903227091 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:08.912480116 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:08.956500053 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:09.232758999 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:09.232774973 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:09.232788086 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:09.232867002 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:09.232877016 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:09.232938051 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:09.233980894 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:09.234014034 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:09.234040022 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:09.234044075 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:09.234069109 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:09.234091043 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:09.236846924 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:09.236855030 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:09.236864090 CEST	49797	443	192.168.2.4	40.68.123.157
Aug 29, 2024 21:28:09.236869097 CEST	443	49797	40.68.123.157	192.168.2.4
Aug 29, 2024 21:28:11.858539104 CEST	49724	80	192.168.2.4	199.232.214.172
Aug 29, 2024 21:28:11.863894939 CEST	80	49724	199.232.214.172	192.168.2.4
Aug 29, 2024 21:28:11.863981962 CEST	49724	80	192.168.2.4	199.232.214.172
Aug 29, 2024 21:28:12.303559065 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:12.303664923 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:12.303730965 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:28:12.312062979 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:12.312125921 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:12.312176943 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:28:13.186623096 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:28:13.186655998 CEST	443	49770	142.251.40.206	192.168.2.4
Aug 29, 2024 21:28:13.186690092 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:28:13.186696053 CEST	443	49769	142.251.40.206	192.168.2.4
Aug 29, 2024 21:28:14.960339069 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:14.960357904 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:14.960402012 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:14.960410118 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:14.960463047 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:28:14.962446928 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:28:17.395554066 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.395596027 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.395669937 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.395840883 CEST	49799	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.395872116 CEST	443	49799	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.395920992 CEST	49799	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.396132946 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.396150112 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.396274090 CEST	49799	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.396286011 CEST	443	49799	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.864456892 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.864880085 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.864913940 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.865242004 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.865539074 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.865602970 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.865725040 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.882771015 CEST	443	49799	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.884581089 CEST	49799	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.884593964 CEST	443	49799	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.884963989 CEST	443	49799	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.885221958 CEST	49799	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.885277033 CEST	443	49799	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.912512064 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.941221952 CEST	49799	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.998749018 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.998811007 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.998879910 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:18.002367020 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:18.002391100 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:26.359230042 CEST	49764	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:26.359235048 CEST	49765	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:26.359251022 CEST	443	49765	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:26.359251022 CEST	443	49764	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:32.786655903 CEST	443	49799	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:32.786720991 CEST	443	49799	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:32.786767006 CEST	49799	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:36.267884970 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:28:36.267919064 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:36.267934084 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:28:36.267939091 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:57.311460018 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:28:57.311477900 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:57.312447071 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:28:57.312465906 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 29, 2024 21:28:58.202104092 CEST	49770	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:28:58.202133894 CEST	443	49770	142.251.40.206	192.168.2.4
Aug 29, 2024 21:28:58.202164888 CEST	49769	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:28:58.202171087 CEST	443	49769	142.251.40.206	192.168.2.4
Aug 29, 2024 21:29:11.359675884 CEST	49764	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:29:11.359685898 CEST	49765	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:29:11.359694004 CEST	443	49764	162.159.61.3	192.168.2.4
Aug 29, 2024 21:29:11.359714985 CEST	443	49765	162.159.61.3	192.168.2.4
Aug 29, 2024 21:29:17.796349049 CEST	49799	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:29:17.796375036 CEST	443	49799	162.159.61.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 21:27:18.971455097 CEST	53	54247	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:20.327553988 CEST	54086	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:20.327553988 CEST	57750	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:21.757797003 CEST	53	60667	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:21.769222975 CEST	53	60634	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:23.257163048 CEST	61803	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:23.257479906 CEST	60753	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:23.258023977 CEST	51511	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:23.258361101 CEST	64714	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:23.259141922 CEST	56995	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:23.259459972 CEST	58971	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:23.260279894 CEST	63698	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:23.260471106 CEST	49750	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:23.263912916 CEST	53	61803	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:23.264338970 CEST	53	60753	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:23.265209913 CEST	53	64714	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:23.265275955 CEST	53	51511	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:23.265800953 CEST	53	56995	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:23.266176939 CEST	53	58971	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:23.266971111 CEST	53	63698	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:23.267518044 CEST	53	49750	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:23.619864941 CEST	50579	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:23.620052099 CEST	59473	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:23.626287937 CEST	138	138	192.168.2.4	192.168.2.255
Aug 29, 2024 21:27:23.628283978 CEST	53	50579	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:23.628679991 CEST	53	59473	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:25.679385900 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:25.983711958 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.144200087 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.144630909 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.144726038 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.144737005 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.144830942 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.150317907 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.150429010 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.150707006 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.150831938 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.249922037 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.249931097 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.250303030 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.250529051 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.250538111 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.250792980 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.251538038 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.251558065 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.251749992 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.337649107 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.338095903 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.348726988 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.395698071 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.437372923 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.438369036 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.438771009 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.439127922 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.663666010 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.663773060 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:26.763689041 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.765526056 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.766325951 CEST	443	52119	162.159.61.3	192.168.2.4
Aug 29, 2024 21:27:26.766484022 CEST	52119	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:27:27.212806940 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.519773960 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.666956902 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.666970015 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.673782110 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.673798084 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.673809052 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.673820019 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.676508904 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.676595926 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.678765059 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.681654930 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.682142973 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.682142973 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.682230949 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.682445049 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.775644064 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.775703907 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.776532888 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.778280973 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.779226065 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.779226065 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.854619026 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.862631083 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.863152027 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.864224911 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:27.975166082 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:27.975271940 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:28.016187906 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.075217962 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:28.087347984 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:35.217243910 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:35.483036995 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:35.634219885 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:35.634263039 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:35.634273052 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:35.634460926 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:35.634828091 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:35.634902000 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:35.726138115 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:35.729840040 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:38.717922926 CEST	60309	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:38.718137026 CEST	60954	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:38.724850893 CEST	53	60309	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:38.725164890 CEST	53	60954	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:41.231987000 CEST	53	55406	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:41.643960953 CEST	62833	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:41.644193888 CEST	52233	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:41.644912958 CEST	64641	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:41.645095110 CEST	55619	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:41.650973082 CEST	53	62833	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:41.650990009 CEST	53	52233	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:41.651487112 CEST	53	64641	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:41.651607990 CEST	53	55619	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:41.868227005 CEST	63896	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:41.868752003 CEST	60830	53	192.168.2.4	1.1.1.1
Aug 29, 2024 21:27:41.876601934 CEST	53	60830	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:41.877456903 CEST	53	63896	1.1.1.1	192.168.2.4
Aug 29, 2024 21:27:56.426265001 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:56.426265001 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:56.520859957 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:56.546034098 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:56.573743105 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:56.613410950 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:56.614557028 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:56.636615038 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:56.666421890 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:56.720380068 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:56.720380068 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:56.756079912 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:56.815346003 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:56.844259977 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:56.903446913 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:56.903902054 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:56.924772024 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.022905111 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:57.233896971 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.456474066 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:57.456516981 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:57.619395971 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.619412899 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.619425058 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.619436026 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.619447947 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.620189905 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.622397900 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.622577906 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.623853922 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.647857904 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.710807085 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:57.721544981 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.721555948 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.721563101 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.721571922 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.721951962 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.722059965 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.742842913 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.745950937 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.746071100 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.746423960 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.749106884 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:57.798207045 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:57.799474001 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:57.799607038 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:57.816108942 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:57.829318047 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:27:57.849782944 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:57.919433117 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:27:58.670414925 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:58.673954010 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:58.676021099 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:58.941819906 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:58.941834927 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:58.941843033 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:58.941853046 CEST	443	56107	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:58.942631006 CEST	56107	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.047056913 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.125181913 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.125195026 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.125206947 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.125221014 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.210607052 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.212579012 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.213097095 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.213418007 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.215030909 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.215161085 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.369779110 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.468667984 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.468713999 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.469296932 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.469331026 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.469353914 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.469475031 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.470081091 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.470427990 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.471347094 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:27:59.565301895 CEST	443	64786	172.64.41.3	192.168.2.4
Aug 29, 2024 21:27:59.592185020 CEST	64786	443	192.168.2.4	172.64.41.3
Aug 29, 2024 21:28:17.395410061 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.702227116 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.881503105 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.881899118 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.882220030 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.882368088 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.882381916 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.882504940 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.883966923 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.884260893 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.884357929 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.884815931 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.983676910 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.983696938 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.983709097 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.983720064 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.984117031 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.984199047 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:17.984715939 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:17.988934040 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:18.030949116 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:18.083440065 CEST	443	64618	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:18.109623909 CEST	64618	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:26.832350016 CEST	59602	443	192.168.2.4	142.251.40.206
Aug 29, 2024 21:28:26.925945997 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:28:26.951416016 CEST	443	59602	142.251.40.206	192.168.2.4
Aug 29, 2024 21:28:28.159746885 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.159957886 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.160286903 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.160387039 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.578185081 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.606875896 CEST	443	64828	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:28.607568979 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.639470100 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.672804117 CEST	443	64828	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:28.672815084 CEST	443	64828	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:28.672822952 CEST	443	64828	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:28.672831059 CEST	443	64828	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:28.673106909 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.673206091 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.702440977 CEST	443	64828	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:28.733249903 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.769619942 CEST	443	64828	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:28.769838095 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.871129990 CEST	443	64828	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:28.873475075 CEST	443	64828	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:28.874938011 CEST	443	64828	162.159.61.3	192.168.2.4
Aug 29, 2024 21:28:28.875232935 CEST	64828	443	192.168.2.4	162.159.61.3
Aug 29, 2024 21:28:28.876337051 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:28.876493931 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.311400890 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.374481916 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:29.374506950 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:29.375092983 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.375284910 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.375534058 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.375545979 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.392618895 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:29.409149885 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:29.409310102 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.472551107 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:29.472773075 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.473268032 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:29.473278046 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:29.473419905 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.508969069 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:29.557569981 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:29.557960987 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.558675051 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:29.592837095 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:29.681902885 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:48.534511089 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:48.534559965 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:49.299252033 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:49.378225088 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:49.381989956 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:49.411292076 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:49.438632965 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:49.538028955 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:57.254604101 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:57.254640102 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:57.353179932 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:57.390763998 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:57.429766893 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:57.430082083 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:57.431978941 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:28:57.468766928 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:28:57.553903103 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:29:00.597421885 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:29:00.720473051 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:29:00.750782967 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:29:00.779366016 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:29:00.779587030 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:29:00.783071041 CEST	443	56715	142.250.72.110	192.168.2.4
Aug 29, 2024 21:29:00.813036919 CEST	56715	443	192.168.2.4	142.250.72.110
Aug 29, 2024 21:29:00.963882923 CEST	443	56715	142.250.72.110	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 29, 2024 21:28:26.926003933 CEST	192.168.2.4	142.251.40.206	c9ec	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 21:27:20.327553988 CEST	192.168.2.4	1.1.1.1	0x330	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 29, 2024 21:27:20.327553988 CEST	192.168.2.4	1.1.1.1	0xe154	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.257163048 CEST	192.168.2.4	1.1.1.1	0x57f3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.257479906 CEST	192.168.2.4	1.1.1.1	0x6a8c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 21:27:23.258023977 CEST	192.168.2.4	1.1.1.1	0x133d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.258361101 CEST	192.168.2.4	1.1.1.1	0x1c3d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 21:27:23.259141922 CEST	192.168.2.4	1.1.1.1	0x4868	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.259459972 CEST	192.168.2.4	1.1.1.1	0xa70c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 21:27:23.260279894 CEST	192.168.2.4	1.1.1.1	0xf5eb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.260471106 CEST	192.168.2.4	1.1.1.1	0xad7d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 21:27:23.619864941 CEST	192.168.2.4	1.1.1.1	0x7aac	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.620052099 CEST	192.168.2.4	1.1.1.1	0x241d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 21:27:38.717922926 CEST	192.168.2.4	1.1.1.1	0x219a	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:38.718137026 CEST	192.168.2.4	1.1.1.1	0x3578	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Aug 29, 2024 21:27:41.643960953 CEST	192.168.2.4	1.1.1.1	0x457f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:41.644193888 CEST	192.168.2.4	1.1.1.1	0xc15e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 21:27:41.644912958 CEST	192.168.2.4	1.1.1.1	0xa8a1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:41.645095110 CEST	192.168.2.4	1.1.1.1	0x5109	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 29, 2024 21:27:41.868227005 CEST	192.168.2.4	1.1.1.1	0x9364	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:41.868752003 CEST	192.168.2.4	1.1.1.1	0x3d85	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 21:27:20.335118055 CEST	1.1.1.1	192.168.2.4	0x330	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:20.335186958 CEST	1.1.1.1	192.168.2.4	0xe154	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:22.094168901 CEST	1.1.1.1	192.168.2.4	0x2959	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:22.094168901 CEST	1.1.1.1	192.168.2.4	0x2959	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.263912916 CEST	1.1.1.1	192.168.2.4	0x57f3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.263912916 CEST	1.1.1.1	192.168.2.4	0x57f3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.264338970 CEST	1.1.1.1	192.168.2.4	0x6a8c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 21:27:23.265209913 CEST	1.1.1.1	192.168.2.4	0x1c3d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 21:27:23.265275955 CEST	1.1.1.1	192.168.2.4	0x133d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.265275955 CEST	1.1.1.1	192.168.2.4	0x133d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.265800953 CEST	1.1.1.1	192.168.2.4	0x4868	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.265800953 CEST	1.1.1.1	192.168.2.4	0x4868	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.266176939 CEST	1.1.1.1	192.168.2.4	0xa70c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 21:27:23.266971111 CEST	1.1.1.1	192.168.2.4	0xf5eb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.266971111 CEST	1.1.1.1	192.168.2.4	0xf5eb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.267518044 CEST	1.1.1.1	192.168.2.4	0xad7d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 21:27:23.628283978 CEST	1.1.1.1	192.168.2.4	0x7aac	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.628283978 CEST	1.1.1.1	192.168.2.4	0x7aac	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:23.628679991 CEST	1.1.1.1	192.168.2.4	0x241d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 21:27:38.724850893 CEST	1.1.1.1	192.168.2.4	0x219a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:38.724850893 CEST	1.1.1.1	192.168.2.4	0x219a	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.97	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:38.725164890 CEST	1.1.1.1	192.168.2.4	0x3578	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:39.339643002 CEST	1.1.1.1	192.168.2.4	0xddf6	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:39.339643002 CEST	1.1.1.1	192.168.2.4	0xddf6	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:40.003169060 CEST	1.1.1.1	192.168.2.4	0x158c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:40.003169060 CEST	1.1.1.1	192.168.2.4	0x158c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:40.004170895 CEST	1.1.1.1	192.168.2.4	0x95f5	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:41.232551098 CEST	1.1.1.1	192.168.2.4	0x66ad	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:41.232551098 CEST	1.1.1.1	192.168.2.4	0x66ad	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:41.240217924 CEST	1.1.1.1	192.168.2.4	0x5ab6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:41.650973082 CEST	1.1.1.1	192.168.2.4	0x457f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:41.650973082 CEST	1.1.1.1	192.168.2.4	0x457f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:41.650990009 CEST	1.1.1.1	192.168.2.4	0xc15e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 21:27:41.651487112 CEST	1.1.1.1	192.168.2.4	0xa8a1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:41.651487112 CEST	1.1.1.1	192.168.2.4	0xa8a1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:41.651607990 CEST	1.1.1.1	192.168.2.4	0x5109	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 21:27:41.876601934 CEST	1.1.1.1	192.168.2.4	0x3d85	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 29, 2024 21:27:41.877456903 CEST	1.1.1.1	192.168.2.4	0x9364	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:41.877456903 CEST	1.1.1.1	192.168.2.4	0x9364	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:43.054430008 CEST	1.1.1.1	192.168.2.4	0xa10d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:43.054430008 CEST	1.1.1.1	192.168.2.4	0xa10d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:44.155821085 CEST	1.1.1.1	192.168.2.4	0xa10d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:44.155821085 CEST	1.1.1.1	192.168.2.4	0xa10d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:45.100064039 CEST	1.1.1.1	192.168.2.4	0xa10d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:45.100064039 CEST	1.1.1.1	192.168.2.4	0xa10d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:47.175863028 CEST	1.1.1.1	192.168.2.4	0xa10d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:47.175863028 CEST	1.1.1.1	192.168.2.4	0xa10d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 29, 2024 21:27:51.100919008 CEST	1.1.1.1	192.168.2.4	0xa10d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 21:27:51.100919008 CEST	1.1.1.1	192.168.2.4	0xa10d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49749	13.107.246.60	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:22 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 19:27:22 UTC	583	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 19:27:22 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240829T192722Z-16579567576qxwrndb60my3nes00000002ag00000000a461 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-29 19:27:22 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-29 19:27:22 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-29 19:27:22 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-29 19:27:23 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-29 19:27:23 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49750	13.107.246.60	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:23 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 19:27:23 UTC	559	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 19:27:23 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240829T192723Z-16579567576kv75wmks9m65qec00000002m000000000146k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-29 19:27:23 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49754	162.159.61.3	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 19:27:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 19:27:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 19:27:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8baef02ddfc642d2-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 19:27:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0c 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49751	162.159.61.3	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 19:27:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 19:27:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 19:27:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8baef02e0d07729f-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 19:27:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0d 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49753	162.159.61.3	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 19:27:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 19:27:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 19:27:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8baef02e0b7c7d1c-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 19:27:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49752	162.159.61.3	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 19:27:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 19:27:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 19:27:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8baef02e18fe2363-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 19:27:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 11 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49756	162.159.61.3	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:24 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 19:27:24 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 19:27:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 19:27:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8baef02ff90d4207-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 19:27:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 55 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomUPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49761	162.159.61.3	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:24 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 19:27:24 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 19:27:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 19:27:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8baef032fc8c4368-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 19:27:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f9 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49762	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-29 19:27:25 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=137369 Date: Thu, 29 Aug 2024 19:27:24 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49763	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-29 19:27:26 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=137320 Date: Thu, 29 Aug 2024 19:27:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-29 19:27:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49767	142.251.40.206	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:26 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-29 19:27:27 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 29 Aug 2024 19:27:26 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49766	142.251.40.206	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:26 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-29 19:27:27 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 29 Aug 2024 19:27:27 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49768	142.250.64.68	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:27 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-29 19:27:27 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 29 Aug 2024 18:36:29 GMT Expires: Fri, 06 Sep 2024 18:36:29 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 3058 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-29 19:27:27 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-29 19:27:27 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-29 19:27:27 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-29 19:27:27 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-29 19:27:27 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49771	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:30 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tByBeEzz9nxcwEy&MD=gydSm56F HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-29 19:27:30 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: a5933a1d-c322-433a-9680-51ec6d0c84bd MS-RequestId: 1bc088ae-1b72-4a7f-8684-3985e1b39e1e MS-CV: MzU4GHy9H0K/p6Ye.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 29 Aug 2024 19:27:30 GMT Connection: close Content-Length: 24490
2024-08-29 19:27:30 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-29 19:27:30 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49783	142.250.185.97	443	5016	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:39 UTC	594	OUT	GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 19:27:39 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AHxI1nMwfvJ0smzaLBgesfx_UsIT_kx84xH1AyxbtDr9n9aCm0tnViwkefeoj26tHSQHDD7n4NI X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Thu, 29 Aug 2024 15:56:45 GMT Expires: Fri, 29 Aug 2025 15:56:45 GMT Cache-Control: public, max-age=31536000 Age: 12654 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-29 19:27:39 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-08-29 19:27:39 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-08-29 19:27:39 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-08-29 19:27:39 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-08-29 19:27:39 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-08-29 19:27:39 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-08-29 19:27:39 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-08-29 19:27:39 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-08-29 19:27:39 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-08-29 19:27:39 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49785	13.107.246.60	443	5016	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:40 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 19:27:40 UTC	559	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 19:27:40 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240829T192740Z-16579567576xfl5xzh7yws029s000000029000000000fs36 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-29 19:27:40 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49788	172.64.41.3	443	5016	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 19:27:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 19:27:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 19:27:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8baef0a17d6042a0-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 19:27:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49787	172.64.41.3	443	5016	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 19:27:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 19:27:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 19:27:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8baef0a17c4c8cc6-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 19:27:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 15 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49789	162.159.61.3	443	5016	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 19:27:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-29 19:27:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 19:27:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8baef0a23eca7cf3-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 19:27:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d8 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49792	152.195.19.97	443	5016	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:27:58 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725564459&P2=404&P3=2&P4=MZReESQeVdQg%2bJMGXuyS5L3qgKqqDGoyQdusNtTtWbr%2bh6DiWjtALUMkh96rqeTXSybXZjSbukRLDWYH%2bACr3A%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: xqNstlXKEeAb07QJRLVctD Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-29 19:27:58 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4886209 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Thu, 29 Aug 2024 19:27:58 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-08-29 19:27:58 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49797	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:28:08 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tByBeEzz9nxcwEy&MD=gydSm56F HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-29 19:28:09 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 63827c66-86e9-4652-ba72-1db6d049c512 MS-RequestId: 4e69124e-57a8-4935-9ef1-c53fb98e1ee7 MS-CV: nzmZ1WAod0+eFcQs.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 29 Aug 2024 19:28:08 GMT Connection: close Content-Length: 30005
2024-08-29 19:28:09 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-29 19:28:09 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49798	162.159.61.3	443	7420	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 19:28:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-29 19:28:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-08-29 19:28:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 29 Aug 2024 19:28:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8baef1803c7441cf-EWR alt-svc: h3=":443"; ma=86400
2024-08-29 19:28:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d dc 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 08 00 02 c0 43 c0 43 00 01 00 01 00 00 00 08 00 04 0d 6b 15 ef c0 43 00 01 00 01 00 00 00 08 00 04 cc 4f c5 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCkCO)>:

Target ID:	0
Start time:	15:27:14
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xbb0000
File size:	917'504 bytes
MD5 hash:	21BA5E866BFD9EB0051F4D3648713C62
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	15:27:15
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:27:15
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2000,i,7636510567256851509,10520198468140102036,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:27:15
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7699e0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	15:27:15
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:27:20
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:27:20
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6780 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:27:21
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6456 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff756360000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:27:21
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6456 --field-trial-handle=2040,i,13581919310929330712,150003152427684326,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff756360000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:27:34
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	15:27:35
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:27:35
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4400 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:27:37
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8
Imagebase:	0x7ff756360000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:27:37
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2072,i,9952272124031090318,8602654554773342342,262144 /prefetch:8
Imagebase:	0x7ff756360000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:27:42
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:27:43
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2060,i,7639777188277879245,14507477756352778342,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:27:51
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:27:51
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2052,i,13957771877731099850,4999353375975219962,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:28:04
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:28:05
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1656 --field-trial-handle=2128,i,1638324006078571582,16515703826543556908,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	1398
Total number of Limit Nodes:	43

Executed Functions

Function 00BB42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00BB430D

Part of subcall function 00BB6B57: _wcslen.LIBCMT ref: 00BB6B6A

GetCurrentProcess.KERNEL32(?,00C4CB64,00000000,?,?), ref: 00BB4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00BB4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00BB4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00BB4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00BB4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00BB447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00BB44A0

Strings

|O, xrefs: 00BF36F8
GetNativeSystemInfo, xrefs: 00BB4460
kernel32.dll, xrefs: 00BB444F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: e806f9d53c5c439267a830f29448208411e1c1b60c82f40fe9e11e097dab28c2
Instruction ID: 014472afd6f5e6ff4377a10c2bd0deb70874275ce4d5adb5d00a3d229cf57553
Opcode Fuzzy Hash: e806f9d53c5c439267a830f29448208411e1c1b60c82f40fe9e11e097dab28c2
Instruction Fuzzy Hash: 64A1937595A2C4DFC711D76978817ED7FECBB26B00B0D48E9D88193B32D6604A0ACB29

Function 00BB42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00BB50AA,?,?,00000000,00000000), ref: 00BB42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00BB50AA,?,?,00000000,00000000), ref: 00BB42C9
LoadResource.KERNEL32(?,00000000,?,?,00BB50AA,?,?,00000000,00000000,?,?,?,?,?,?,00BB4F20), ref: 00BF35BE
SizeofResource.KERNEL32(?,00000000,?,?,00BB50AA,?,?,00000000,00000000,?,?,?,?,?,?,00BB4F20), ref: 00BF35D3
LockResource.KERNEL32(00BB50AA,?,?,00BB50AA,?,?,00000000,00000000,?,?,?,?,?,?,00BB4F20,?), ref: 00BF35E6

Strings

SCRIPT, xrefs: 00BB42BF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: a928c6d0843b5f41ae531e9d822a965fa2f113d2e7f292cdd6cd6d406b438731
Instruction ID: 8b7d913815fe0054f02fda63ed0ccacf1528cb8c14afcbd70364f65001d55132
Opcode Fuzzy Hash: a928c6d0843b5f41ae531e9d822a965fa2f113d2e7f292cdd6cd6d406b438731
Instruction Fuzzy Hash: 22117C74201700BFEB258FA5DC89F6B7BB9FBC6B51F1081A9B412962A0DBB1D8049620

Function 00BF2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00BB2B6B

Part of subcall function 00BB3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00C81418,?,00BB2E7F,?,?,?,00000000), ref: 00BB3A78

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00C72224), ref: 00BF2C10
ShellExecuteW.SHELL32(00000000,?,?,00C72224), ref: 00BF2C17

Strings

runas, xrefs: 00BF2C0B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 574d96dd09309555db14dee11c07c94e99b2847211d84bd08f0f6a39ad736457
Instruction ID: 134d3d666d36ceea01e9de6bd756618de802d05d7477bb21ce87ef86232309df
Opcode Fuzzy Hash: 574d96dd09309555db14dee11c07c94e99b2847211d84bd08f0f6a39ad736457
Instruction Fuzzy Hash: 0611B4312083456BC714FF60D891AFE7BE8AB91750F4854ADF546130A3CFE1894A8712

Function 00C1DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00BF5222), ref: 00C1DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00C1DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00C1DBEE
FindClose.KERNEL32(00000000), ref: 00C1DBFA

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: edbbf6364964bf7df6268bf5126befe00761c5afe957379ab4376c4ffc10dfd3
Instruction ID: 48f6878c8d7fef67e64a214214fe3a0abb1f5c80af97422ee09e206a3d42953c
Opcode Fuzzy Hash: edbbf6364964bf7df6268bf5126befe00761c5afe957379ab4376c4ffc10dfd3
Instruction Fuzzy Hash: CCF0A0388119105783306B78AC4DAEE377CAE03334B104B02F936C20F0EBF09A94D6D5

Function 00C3AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00C3B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C3B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C3B1D4
_wcslen.LIBCMT ref: 00C3B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C3B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C3B236
_wcslen.LIBCMT ref: 00C3B332

Part of subcall function 00C205A7: GetStdHandle.KERNEL32(000000F6), ref: 00C205C6

_wcslen.LIBCMT ref: 00C3B34B
_wcslen.LIBCMT ref: 00C3B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C3B3B6
GetLastError.KERNEL32(00000000), ref: 00C3B407
CloseHandle.KERNEL32(?), ref: 00C3B439
CloseHandle.KERNEL32(00000000), ref: 00C3B44A
CloseHandle.KERNEL32(00000000), ref: 00C3B45C
CloseHandle.KERNEL32(00000000), ref: 00C3B46E
CloseHandle.KERNEL32(?), ref: 00C3B4E3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: ff06792ab7ea8c60bc23c4d7f9e8dc87ff01737747472596032af22af000406f
Instruction ID: 9ec3e209dde6092750a8b118aaceba31645f9691e655d9c64ff0a7a34b95bba2
Opcode Fuzzy Hash: ff06792ab7ea8c60bc23c4d7f9e8dc87ff01737747472596032af22af000406f
Instruction Fuzzy Hash: C1F1AC316183009FC724EF24C891B6FBBE5AF85310F14859DF99A9B2A2DB71ED44CB52

Function 00BBD730 Relevance: 21.6, APIs: 14, Instructions: 621windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00BBD807
timeGetTime.WINMM ref: 00BBDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BBDB28
TranslateMessage.USER32(?), ref: 00BBDB7B
DispatchMessageW.USER32(?), ref: 00BBDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BBDB9F
Sleep.KERNELBASE(0000000A), ref: 00BBDBB1

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 1b4ae2d828c6c38f90b09bffc29d3e9f4ba380be1f8b6f2de78ea635c76d3f55
Instruction ID: d202acbf9c01ef28899dbbe57add126e38cb6a0f3128f977a016d4e8868b2515
Opcode Fuzzy Hash: 1b4ae2d828c6c38f90b09bffc29d3e9f4ba380be1f8b6f2de78ea635c76d3f55
Instruction Fuzzy Hash: F442D430608241DFD729CF24C888BBAB7E4FF45314F58469DE9A687291E7B4E944DB82

Function 00BB2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BB2D07
RegisterClassExW.USER32(00000030), ref: 00BB2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BB2D42
InitCommonControlsEx.COMCTL32(?), ref: 00BB2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BB2D6F
LoadIconW.USER32(000000A9), ref: 00BB2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BB2D94

Strings

AutoIt v3 GUI, xrefs: 00BB2D23
0, xrefs: 00BB2CE9
+, xrefs: 00BB2CF0
TaskbarCreated, xrefs: 00BB2D37

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 865a63ea4186848ed1b11b1436cd8316b6cc9667b51c0b489f4e4517296f4bf2
Instruction ID: 5e32f6961f4a61667f8db52fe930ba847a4dea8bafccbd7e5fd45423743c8a7b
Opcode Fuzzy Hash: 865a63ea4186848ed1b11b1436cd8316b6cc9667b51c0b489f4e4517296f4bf2
Instruction Fuzzy Hash: F321C2B5912318AFDB40DFA4EC89BDDBBF8FB09700F04811AF911A62A0D7B15545CF95

Function 00BF065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF039A: CreateFileW.KERNELBASE(00000000,00000000,?,00BF0704,?,?,00000000,?,00BF0704,00000000,0000000C), ref: 00BF03B7

GetLastError.KERNEL32 ref: 00BF076F
__dosmaperr.LIBCMT ref: 00BF0776
GetFileType.KERNELBASE(00000000), ref: 00BF0782
GetLastError.KERNEL32 ref: 00BF078C
__dosmaperr.LIBCMT ref: 00BF0795
CloseHandle.KERNEL32(00000000), ref: 00BF07B5
CloseHandle.KERNEL32(?), ref: 00BF08FF
GetLastError.KERNEL32 ref: 00BF0931
__dosmaperr.LIBCMT ref: 00BF0938

Strings

H, xrefs: 00BF08BD

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: bc2d95566a750177b6250a2662818e9290fc7ef58e067cf3f397c6bae8d45162
Instruction ID: 35cb05d141bf184cbd41217ee4c2b6a54b3715ad5f7ef58ff3bdccd4ea4d7afe
Opcode Fuzzy Hash: bc2d95566a750177b6250a2662818e9290fc7ef58e067cf3f397c6bae8d45162
Instruction Fuzzy Hash: DCA11736A141088FDF19AF68D8917BE7BE0EB06320F144199F9159F3A2D7319D1ACB91

Function 00BB344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00C81418,?,00BB2E7F,?,?,?,00000000), ref: 00BB3A78

Part of subcall function 00BB3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00BB3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00BB356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00BF318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00BF31CE
RegCloseKey.ADVAPI32(?), ref: 00BF3210
_wcslen.LIBCMT ref: 00BF3277
_wcslen.LIBCMT ref: 00BF3286

Strings

Software\AutoIt v3\AutoIt, xrefs: 00BB3560
\, xrefs: 00BF328C
\Include\, xrefs: 00BB3527
Include, xrefs: 00BF3184, 00BF31C5

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: deb210b70338b59c36be432e9e14fc719d5b9abb8fa4afae5332b4fae0e3eef6
Instruction ID: dc4a7bef23cf977075ae48700408a741e05de2b2885b9840dd67cdac5bcf019d
Opcode Fuzzy Hash: deb210b70338b59c36be432e9e14fc719d5b9abb8fa4afae5332b4fae0e3eef6
Instruction Fuzzy Hash: 207199714043019FC314EF69EC96AAFBBE8FF85740B40086EF585931B0EB749A48CB66

Function 00BB2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BB2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00BB2B9D
LoadIconW.USER32(00000063), ref: 00BB2BB3
LoadIconW.USER32(000000A4), ref: 00BB2BC5
LoadIconW.USER32(000000A2), ref: 00BB2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00BB2BEF
RegisterClassExW.USER32(?), ref: 00BB2C40

Part of subcall function 00BB2CD4: GetSysColorBrush.USER32(0000000F), ref: 00BB2D07
Part of subcall function 00BB2CD4: RegisterClassExW.USER32(00000030), ref: 00BB2D31
Part of subcall function 00BB2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BB2D42
Part of subcall function 00BB2CD4: InitCommonControlsEx.COMCTL32(?), ref: 00BB2D5F
Part of subcall function 00BB2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BB2D6F
Part of subcall function 00BB2CD4: LoadIconW.USER32(000000A9), ref: 00BB2D85
Part of subcall function 00BB2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BB2D94

Strings

AutoIt v3, xrefs: 00BB2C2F
0, xrefs: 00BB2C0F
#, xrefs: 00BB2C16

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: c1a19f9e01a36ba71cb43b5cb86914a090974c3af8bdefe72fdf4d8f6e3b2253
Instruction ID: ca43dd104a87206fc90acbd284142a3d2d9000f14b0bf000f7f1516ccc587263
Opcode Fuzzy Hash: c1a19f9e01a36ba71cb43b5cb86914a090974c3af8bdefe72fdf4d8f6e3b2253
Instruction Fuzzy Hash: 8B212975E01318ABDB109FA5EC95BED7FF8FB48B50F08005AEA10A66B0D7B10541CF98

Function 00BB3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00BB316A,?,?), ref: 00BB31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00BB316A,?,?), ref: 00BB3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00BB3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00BB316A,?,?), ref: 00BB3232
CreatePopupMenu.USER32 ref: 00BB3246
PostQuitMessage.USER32(00000000), ref: 00BB3267

Strings

TaskbarCreated, xrefs: 00BB322D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 3329a6352dcab32bea374c7a5be206013526a6f9e1b6eaa40ea25669476728ed
Instruction ID: 88d0a50f092451faafd11787f5342207c568f98efb7e6cf5ba4ca18520fc4ea4
Opcode Fuzzy Hash: 3329a6352dcab32bea374c7a5be206013526a6f9e1b6eaa40ea25669476728ed
Instruction Fuzzy Hash: DE411535240208A7DB146B7CDC8ABFD3ADDEB06B44F0801A5F902962B1CBF19E419765

Function 00BB2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00BB2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00BB2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00BB1CAD,?), ref: 00BB2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00BB1CAD,?), ref: 00BB2CCF

Strings

AutoIt v3, xrefs: 00BB2C89, 00BB2C8E, 00BB2C8F
edit, xrefs: 00BB2CAC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 7ce1be6d3bae71aeb8701aba9774e2692a004120560dfd6e49f9945e1484b3df
Instruction ID: 7d2ebc339895ff651619bd9f21ee0fef20dab80691564dcc9bd12ac39f6aa145
Opcode Fuzzy Hash: 7ce1be6d3bae71aeb8701aba9774e2692a004120560dfd6e49f9945e1484b3df
Instruction Fuzzy Hash: 8BF0DA755413A07AEB711B17AC48FBB2EBDE7C7F50B04005AFD00A25B0C6755852DBB8

Function 00C1E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00C1E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00C1E9A5
Sleep.KERNEL32(00000000), ref: 00C1E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00C1E9B7
Sleep.KERNELBASE ref: 00C1E9F3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: a76a19058438561155bf33b77a2617c8678542f06b33405acf70d89fc7c90836
Instruction ID: 071452f8a3a3bb108fbb5c4fc16ef72753f5f17926d27401b344a14a8d9a8c4e
Opcode Fuzzy Hash: a76a19058438561155bf33b77a2617c8678542f06b33405acf70d89fc7c90836
Instruction Fuzzy Hash: 31015B35C0252DDBCF40ABE5D889BEDBB78BB0A701F000586E912F2260DB3096959761

Function 00BB3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00BB3B0F,SwapMouseButtons,00000004,?), ref: 00BB3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00BB3B0F,SwapMouseButtons,00000004,?), ref: 00BB3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00BB3B0F,SwapMouseButtons,00000004,?), ref: 00BB3B83

Strings

Control Panel\Mouse, xrefs: 00BB3B3E

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 8c9363757ad4085d6ce97facbd2802f756650bad1c7e238ba4d0cf8ff1fc88b6
Instruction ID: f347fcef0af1847e5e5f1ff7586feb9236ee75f1a7d460a1a7c2cccfcc3cee1e
Opcode Fuzzy Hash: 8c9363757ad4085d6ce97facbd2802f756650bad1c7e238ba4d0cf8ff1fc88b6
Instruction Fuzzy Hash: 54112AB5511208FFDB208FA5DC84AFEB7F8EF05B44B104599A805D7124D6719E409760

Function 00BB3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00BF33A2

Part of subcall function 00BB6B57: _wcslen.LIBCMT ref: 00BB6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00BB3A04

Strings

Line: , xrefs: 00BF33EB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 24734586fe6fee7b01c65d1564a07c529c0f53d49df7c758b1fd952dfe93d34c
Instruction ID: f80c8f8e10c5e85909519575f582571fb6ff37b4c8897d605a4d81768baf37df
Opcode Fuzzy Hash: 24734586fe6fee7b01c65d1564a07c529c0f53d49df7c758b1fd952dfe93d34c
Instruction Fuzzy Hash: 2031B471408304ABD725EB20DC45BFFB7DCAB40B10F1445AAF599931A1EBF49A49C7C6

Function 00BCFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00BD0668

Part of subcall function 00BD32A4: RaiseException.KERNEL32(?,?,?,00BD068A,?,00C81444,?,?,?,?,?,?,00BD068A,00BB1129,00C78738,00BB1129), ref: 00BD3304

__CxxThrowException@8.LIBVCRUNTIME ref: 00BD0685

Strings

Unknown exception, xrefs: 00BD0692

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 06bea099dbe35c8b4840df8db8e6b99a27cbcb6122e8bc9d85c79154a8ac7b6b
Instruction ID: 438e8b0280248e2b3f63b96309ce22e12db8e5710e9dd903110b16480ee63218
Opcode Fuzzy Hash: 06bea099dbe35c8b4840df8db8e6b99a27cbcb6122e8bc9d85c79154a8ac7b6b
Instruction Fuzzy Hash: E8F0C83490020D77CB04BA64E88AE5DF7ED9E00350F6041F6B914D6692FF71DA59C595

Function 00BB10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BB1BF4
Part of subcall function 00BB1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00BB1BFC
Part of subcall function 00BB1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BB1C07
Part of subcall function 00BB1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BB1C12
Part of subcall function 00BB1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00BB1C1A
Part of subcall function 00BB1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00BB1C22

Part of subcall function 00BB1B4A: RegisterWindowMessageW.USER32(00000004,?,00BB12C4), ref: 00BB1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00BB136A
OleInitialize.OLE32 ref: 00BB1388
CloseHandle.KERNEL32(00000000,00000000), ref: 00BF24AB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 846f83a31cee2ca29c470592ab9c6a128b98b17a1ca863ec249d75f19acb5ab5
Instruction ID: 6db8a2a94abc12d766229304d18584e9c13e8f5c99aa6d9ea72186266f28bebc
Opcode Fuzzy Hash: 846f83a31cee2ca29c470592ab9c6a128b98b17a1ca863ec249d75f19acb5ab5
Instruction Fuzzy Hash: 7171BAB49112009FC784EF79A8567A93AE8FB8934475D856EA80AC72B2EB704402CF4C

Function 00C1C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00BB3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C1C259
KillTimer.USER32(?,00000001,?,?), ref: 00C1C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C1C270

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 353693e101a184e705c87c5672c7c7a8f69718d8dc811e095058a4841a745374
Instruction ID: e8d9ba9deb37036cb7f245bcb7e65cb03ed0e28b0ddb70ebc1ae02feecc45bc4
Opcode Fuzzy Hash: 353693e101a184e705c87c5672c7c7a8f69718d8dc811e095058a4841a745374
Instruction Fuzzy Hash: 4C31C370944344AFEB328F64C8D5BEBBBECAB17304F04049AE5EA93241C7745AC5DB51

Function 00BE86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00BE85CC,?,00C78CC8,0000000C), ref: 00BE8704
GetLastError.KERNEL32(?,00BE85CC,?,00C78CC8,0000000C), ref: 00BE870E
__dosmaperr.LIBCMT ref: 00BE8739

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 482519c91ac29b3b875ae3882dba305ff09a7687b5042932ba7510e9c03edf2d
Instruction ID: 10fce9fd3c2cda5cc66b391a7ac0b3046233561f8b46b5338fd2c842bbcfb4f1
Opcode Fuzzy Hash: 482519c91ac29b3b875ae3882dba305ff09a7687b5042932ba7510e9c03edf2d
Instruction Fuzzy Hash: ED018E32605AE01EC2706736688577E67C9CF82778F3901D9F81D8B1E2DFA4CC81C254

Function 00BBDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00BBDB7B
DispatchMessageW.USER32(?), ref: 00BBDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BBDB9F
Sleep.KERNELBASE(0000000A), ref: 00BBDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00C01CC9

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 9b03bc033a31ddcfd52300330f57a701b5c6242bd2e9db0179b63f57fa2228b5
Instruction ID: 7092d29969ba5e1a91cea631a2ee74a90f6e8a024831b924c913c5d460378854
Opcode Fuzzy Hash: 9b03bc033a31ddcfd52300330f57a701b5c6242bd2e9db0179b63f57fa2228b5
Instruction Fuzzy Hash: 79F05E306453409BEB70CB60CC89FEE73ECEB49351F144668EA1AC30D0EB749548CB25

Function 00BC1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BC17F6

Strings

CALL, xrefs: 00BC17C6

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 0f7293d418adbe99bc13216ae8460a6abb789b3023738ebfd3a67ab8ce245013
Instruction ID: ee3fb85348a97af474d6e820cd9a0017a8a3572bb80c9c56f2583d42e1eaab2d
Opcode Fuzzy Hash: 0f7293d418adbe99bc13216ae8460a6abb789b3023738ebfd3a67ab8ce245013
Instruction Fuzzy Hash: 79227A706082019FC714DF18C884F2ABBF1BF96314F2489ADF4969B3A2D771E955CB92

Function 00BB2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00BF2C8C

Part of subcall function 00BB3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BB3A97,?,?,00BB2E7F,?,?,?,00000000), ref: 00BB3AC2

Part of subcall function 00BB2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00BB2DC4

Strings

X, xrefs: 00BF2C5A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: e89be81b8eee789c0e0f96649776c6c029bfca9357855465400edd79b409d9ff
Instruction ID: 343d603ab86c73d415cd0ef123805bb64a64c596b630297d41890bf151f2bde4
Opcode Fuzzy Hash: e89be81b8eee789c0e0f96649776c6c029bfca9357855465400edd79b409d9ff
Instruction Fuzzy Hash: 6A216371A102589FDF41DF94C845BEE7BF8AF49714F008099E509A7241DBF49A49CF61

Function 00BB3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BB3908

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: a3c6a1a39695180fac6d9be693463e4a95868671bd5b3491b1f9c57e6e4486ad
Instruction ID: 7206ba7222b8760bc850f9fc44295c08e7335447dd76f2952e82ecbc29f04e44
Opcode Fuzzy Hash: a3c6a1a39695180fac6d9be693463e4a95868671bd5b3491b1f9c57e6e4486ad
Instruction Fuzzy Hash: 4131A270504701DFD721DF24D8847EBBBE8FB49B18F04096EFA9A83250E7B1AA44CB56

Function 00BCF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00BCF661

Part of subcall function 00BBD730: GetInputState.USER32 ref: 00BBD807

Sleep.KERNEL32(00000000), ref: 00C0F2DE

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 7e770eee759aef81788c1f0cebb951fd8259f4473242c1217ef00faba65c16f7
Instruction ID: 724e6e83e29be935000c6dac125e2c3ea47442552db3500a6449b07f98383bea
Opcode Fuzzy Hash: 7e770eee759aef81788c1f0cebb951fd8259f4473242c1217ef00faba65c16f7
Instruction Fuzzy Hash: 0BF08C352402059FD360EF69D499FAAB7E8FF56760F0000ADE85AC72A0DBB0A800CB91

Function 00BBB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BBBB4E

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 5176a03122c7246f48a6e19a356ab27a0f927ed0e7b03397e134bee2c309a707
Instruction ID: b686ae3dc81e899dc32582cff69195833e91d58d40f520e9e9cd97c838d890d9
Opcode Fuzzy Hash: 5176a03122c7246f48a6e19a356ab27a0f927ed0e7b03397e134bee2c309a707
Instruction Fuzzy Hash: 6B328B74A002099FDB24CF54C898FBEB7F9EF44314F258099E955AB2A1C7B4EE41CB91

Function 00C42598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00C42649

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 8fa73af9a56be12823d86e9c8409abf874046beb9c220ac2101764ee167fe5c8
Instruction ID: ddf8ca987e8139770fc7401c4d3ff5a3b97a3f8877cd74a3281ae4fb1d904717
Opcode Fuzzy Hash: 8fa73af9a56be12823d86e9c8409abf874046beb9c220ac2101764ee167fe5c8
Instruction Fuzzy Hash: 4E21F674200615AFD720DF15C8D1DB6B7A9FF45368B9580ACF8668B392CB71ED41CB90

Function 00C413B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00C41420

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a0e3bb99952f8c3ea671df49e06d8f99112c5404672b8dbad492a56680fca7f0
Instruction ID: 24878e5ae09a384f41e3319a7fcda41a4f8f2b46b246b782a51acfbdf46a24b4
Opcode Fuzzy Hash: a0e3bb99952f8c3ea671df49e06d8f99112c5404672b8dbad492a56680fca7f0
Instruction Fuzzy Hash: 4B319430604602AFD714DF25C495B79B7E2FF45324F0881A8E86A4F292DB75EC85CBD0

Function 00BB4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00BB4EDD,?,00C81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BB4E9C
Part of subcall function 00BB4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00BB4EAE
Part of subcall function 00BB4E90: FreeLibrary.KERNEL32(00000000,?,?,00BB4EDD,?,00C81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BB4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00C81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BB4EFD

Part of subcall function 00BB4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00BF3CDE,?,00C81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BB4E62
Part of subcall function 00BB4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00BB4E74
Part of subcall function 00BB4E59: FreeLibrary.KERNEL32(00000000,?,?,00BF3CDE,?,00C81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BB4E87

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: c83d32a6a470aa50b9191134951fee1a0bf297c03522b8ab4a2d70764934ae2d
Instruction ID: 0bde90bc7ff6f853a3e97595b19f3b7b12d0c3fa966095478ac048f033d21567
Opcode Fuzzy Hash: c83d32a6a470aa50b9191134951fee1a0bf297c03522b8ab4a2d70764934ae2d
Instruction Fuzzy Hash: 1A11BF32600205ABCB24AB64DC42BFD77E5FF40B10F108469F546AB1D2EFB0EA459B50

Function 00BE8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00BE8440

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 1d7f3c2b2817566194958a733080d6627c8200e0bc65305a8ca0ee4d82f437f6
Instruction ID: e6a51e245b05747e673344f527ea0d6be8b200dc543527365f039b339af7711f
Opcode Fuzzy Hash: 1d7f3c2b2817566194958a733080d6627c8200e0bc65305a8ca0ee4d82f437f6
Instruction Fuzzy Hash: 06112A7590410AAFCF05DF59E941AAE7BF5EF48314F104099FC08AB352DB31DA15CBA5

Function 00BE5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BE4C7D: RtlAllocateHeap.NTDLL(00000008,00BB1129,00000000,?,00BE2E29,00000001,00000364,?,?,?,00BDF2DE,00BE3863,00C81444,?,00BCFDF5,?), ref: 00BE4CBE

_free.LIBCMT ref: 00BE506C

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 16beea4e5cba540c04e5f2da46fbebce1577a98bfb1923b619a51b5f39e434a2
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: C50126722047486BE3318F669885A5AFBECFB89370F25066DF184832C1EB70A805C6B4

Function 00C429BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00C414B5,?), ref: 00C42A01

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8fdb8c7ee5734e96e76ca799538958b44daf39cecca52889b3d03e9ab7a3b28c
Instruction ID: e087a16b9f0600cf852fd65c242e6ca9d1006fa20e7ddf00a6eb12f451683a7f
Opcode Fuzzy Hash: 8fdb8c7ee5734e96e76ca799538958b44daf39cecca52889b3d03e9ab7a3b28c
Instruction Fuzzy Hash: 5401B136300A419FD334CA2DC456B2677A2FF85318FA98468E4578B251DB32ED42D7A0

Function 00BDE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 90fa97f529317bf4cbe0ea1965f389bf47151502aa641e5030cd582e17893e8d
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: C8F0F432510A149AC6313A6A9C05B5AB7DCDF53334F1007EBF4359A3D2EB74E80286A5

Function 00C4149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00C414EB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: fc64b11bf63b62359c7ced73dc6adec37b9a6aee35941b06400ac4ed4b685d4c
Instruction ID: dacc0ff96496929fe63bd9d9994a6abce14cd8e8b1150cf7d39ca5a1e5ae0716
Opcode Fuzzy Hash: fc64b11bf63b62359c7ced73dc6adec37b9a6aee35941b06400ac4ed4b685d4c
Instruction Fuzzy Hash: 1A01DF353047419F9320CF6AC44092ABBA5FF8532475880A9EC8A8B712D672DDC2CB80

Function 00BE4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00BB1129,00000000,?,00BE2E29,00000001,00000364,?,?,?,00BDF2DE,00BE3863,00C81444,?,00BCFDF5,?), ref: 00BE4CBE

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ee1ba7183f64e21b5060412e9cc7f21b2463629612850ea1056785af7409c28e
Instruction ID: 2007fcd3d04adf9a42ca67fdf9062bf66a696ca62633608dc3260f30d4fa44a2
Opcode Fuzzy Hash: ee1ba7183f64e21b5060412e9cc7f21b2463629612850ea1056785af7409c28e
Instruction Fuzzy Hash: 6BF0E2316072A4A7DB215F639C09B5B77C8FF817A0B3841A2BC1AAB790DB70D80186E0

Function 00BE3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00C81444,?,00BCFDF5,?,?,00BBA976,00000010,00C81440,00BB13FC,?,00BB13C6,?,00BB1129), ref: 00BE3852

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c9fc1510641bc0c859a7ca71a6e019a22d20a9bc967bca1c66c8cffcb9bcfcd2
Instruction ID: 27791fe13d994061070994c1b50937b86000a53e82d4cea47252b9d47367acf8
Opcode Fuzzy Hash: c9fc1510641bc0c859a7ca71a6e019a22d20a9bc967bca1c66c8cffcb9bcfcd2
Instruction Fuzzy Hash: F1E0E5311012A4A7D63126679C09B9A77C8EB82FB0F0501A2BC0593590EB20DD0183E4

Function 00BB4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00C81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BB4F6D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 94e9ef077fee230a420ebefff6ea47bf5edb46a2cf90bf507ead8a8404267c29
Instruction ID: f05e55a71247dc3eb9114b3ba1acc8bc147bc289d2ad5efb84a9bc5120865dcd
Opcode Fuzzy Hash: 94e9ef077fee230a420ebefff6ea47bf5edb46a2cf90bf507ead8a8404267c29
Instruction Fuzzy Hash: EEF01571505752CFDB349F64D4909B6BBE4FF1432932089AEE1EE83622C7B19844DF10

Function 00C42A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00C42A66

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 233f93b5030ef05fb656cf5e1ae7913845ed8fbf9ec6b2c543965f62d3f0e6cd
Instruction ID: 38d56d38495ac7ad2583d95ee6dc22ecd3df5fc3fac83f770d8bc21cf9829241
Opcode Fuzzy Hash: 233f93b5030ef05fb656cf5e1ae7913845ed8fbf9ec6b2c543965f62d3f0e6cd
Instruction Fuzzy Hash: EBE08636350126AAC754EB31EC859FE735CFF51395B504536FC26C3150DB309A96B6E0

Function 00BB2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00BB2DC4

Part of subcall function 00BB6B57: _wcslen.LIBCMT ref: 00BB6B6A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: e99bf3bb6f886a0873a73402ed0bb63da4450ab69ebd6f73f72d075a8a5c47c4
Instruction ID: f97febe97fba816bf6dfa948c5c4f4cbd8a617630c5d5f1269337adf37bbbc33
Opcode Fuzzy Hash: e99bf3bb6f886a0873a73402ed0bb63da4450ab69ebd6f73f72d075a8a5c47c4
Instruction Fuzzy Hash: 60E0CD766011245BC7209258DC06FEA77EDDFC8790F0400B1FE09D7258D9A4AD848550

Function 00BB2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BB3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BB3908

Part of subcall function 00BBD730: GetInputState.USER32 ref: 00BBD807

SetCurrentDirectoryW.KERNEL32(?), ref: 00BB2B6B

Part of subcall function 00BB30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00BB314E

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 3610bbb50cbcf4d90ac110f9004402798cdd251f7b761ef4a94504a4bbd1248f
Instruction ID: a160c843d4402ef8ebbcaaca50b49797f61c585d8a58d25215c30119fb9ac16d
Opcode Fuzzy Hash: 3610bbb50cbcf4d90ac110f9004402798cdd251f7b761ef4a94504a4bbd1248f
Instruction Fuzzy Hash: ADE0862130424407CA04BB759852BFDA7D99BD1755F4415BEF54243163DEA589464352

Function 00C13D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C13D18

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: cc4fb30400268c782a60e6bc84807fc3a62a9cf9b7996f316371c4d0dfe52b8e
Instruction ID: d5fcaffc2973673f6e06491459a4bd8d48752e4f191167b4918614593b9b23a0
Opcode Fuzzy Hash: cc4fb30400268c782a60e6bc84807fc3a62a9cf9b7996f316371c4d0dfe52b8e
Instruction Fuzzy Hash: 9BD012E0AA03087EFB4083718C0BEBB329CD316A81F008BA47A02D64C1D9A0DE080130

Function 00BF039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00BF0704,?,?,00000000,?,00BF0704,00000000,0000000C), ref: 00BF03B7

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f3d15a855fbe583d549d94eb9ac012e34debfbf0f4c85f6052ce82a02135d60e
Instruction ID: bc4c99680e6d3cac7b6514d30b1e90f985a0198920faea333200707769de90bb
Opcode Fuzzy Hash: f3d15a855fbe583d549d94eb9ac012e34debfbf0f4c85f6052ce82a02135d60e
Instruction Fuzzy Hash: 5BD06C3204010DBBDF028F84DD46EDE3BAAFB48714F014000BE1856020C732E821AB90

Function 00BB1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00BB1CBC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 2a29f85561cfe407c0aad83775d1f628030cb75e15e61196480593fc9164d1c6
Instruction ID: 67716889e1e81f9728942d338234d387d356241ac300222d5dc6b7f29ba84c24
Opcode Fuzzy Hash: 2a29f85561cfe407c0aad83775d1f628030cb75e15e61196480593fc9164d1c6
Instruction Fuzzy Hash: DFC04C352802049AE2144B80BC4AF587754A348B00F044001F609555F382A12410A754

Non-executed Functions

Function 00C49576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BC9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00C4961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C4965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00C4969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C496C9
SendMessageW.USER32 ref: 00C496F2
GetKeyState.USER32(00000011), ref: 00C4978B
GetKeyState.USER32(00000009), ref: 00C49798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C497AE
GetKeyState.USER32(00000010), ref: 00C497B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C497E9
SendMessageW.USER32 ref: 00C49810
SendMessageW.USER32(?,00001030,?,00C47E95), ref: 00C49918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00C4992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00C49941
SetCapture.USER32(?), ref: 00C4994A
ClientToScreen.USER32(?,?), ref: 00C499AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00C499BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C499D6
ReleaseCapture.USER32 ref: 00C499E1
GetCursorPos.USER32(?), ref: 00C49A19
ScreenToClient.USER32(?,?), ref: 00C49A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C49A80
SendMessageW.USER32 ref: 00C49AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C49AEB
SendMessageW.USER32 ref: 00C49B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00C49B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00C49B4A
GetCursorPos.USER32(?), ref: 00C49B68
ScreenToClient.USER32(?,?), ref: 00C49B75
GetParent.USER32(?), ref: 00C49B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C49BFA
SendMessageW.USER32 ref: 00C49C2B
ClientToScreen.USER32(?,?), ref: 00C49C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00C49CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C49CDE
SendMessageW.USER32 ref: 00C49D01
ClientToScreen.USER32(?,?), ref: 00C49D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00C49D82

Part of subcall function 00BC9944: GetWindowLongW.USER32(?,000000EB), ref: 00BC9952

GetWindowLongW.USER32(?,000000F0), ref: 00C49E05

Strings

@GUI_DRAGID, xrefs: 00C4997D
F, xrefs: 00C49D07

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: cf7e9d3dd1ac7340767ce7122804712019fc7a5f5890dc4ed5393b05338a5af1
Instruction ID: e8e12c7456804b518f27d467420170db3f71a08b87ea073e7c9d4136e9fe3f85
Opcode Fuzzy Hash: cf7e9d3dd1ac7340767ce7122804712019fc7a5f5890dc4ed5393b05338a5af1
Instruction Fuzzy Hash: FF427734604611AFDB20CF28C884FABBBF9FF49320F154659FAA9872A1D731A951CF51

Function 00C44873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00C448F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00C44908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00C44927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00C4494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00C4495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00C4497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00C449AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00C449D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00C44A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00C44A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00C44A7E
IsMenu.USER32(?), ref: 00C44A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C44AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C44B20
GetWindowLongW.USER32(?,000000F0), ref: 00C44B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00C44BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00C44C82
wsprintfW.USER32 ref: 00C44CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C44CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00C44CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00C44D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C44D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00C44D5A

Strings

%d/%02d/%02d, xrefs: 00C44CA8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: b6ed2a6a58aad0dbe913766c57b15a6557e3e83bddd65c58a63de412ce451577
Instruction ID: 9e3dc55b6d868b8dde43cdf318a5dc3b886e7166a48b535d1a6dce9120110622
Opcode Fuzzy Hash: b6ed2a6a58aad0dbe913766c57b15a6557e3e83bddd65c58a63de412ce451577
Instruction Fuzzy Hash: 4412F271A00215ABEB288F65CC49FAE7BF8FF45710F204169F926DB2E1DB749A41CB50

Function 00BCF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00BCF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C0F474
IsIconic.USER32(00000000), ref: 00C0F47D
ShowWindow.USER32(00000000,00000009), ref: 00C0F48A
SetForegroundWindow.USER32(00000000), ref: 00C0F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00C0F4AA
GetCurrentThreadId.KERNEL32 ref: 00C0F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00C0F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00C0F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00C0F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00C0F4DE
SetForegroundWindow.USER32(00000000), ref: 00C0F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C0F4F6
keybd_event.USER32(00000012,00000000), ref: 00C0F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C0F50B
keybd_event.USER32(00000012,00000000), ref: 00C0F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C0F519
keybd_event.USER32(00000012,00000000), ref: 00C0F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C0F528
keybd_event.USER32(00000012,00000000), ref: 00C0F52D
SetForegroundWindow.USER32(00000000), ref: 00C0F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00C0F557

Strings

Shell_TrayWnd, xrefs: 00C0F46F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: a39e61028d3f4c4838a31440bf5ce7b60a881add5d1fdf9b2c842a7c0df228f9
Instruction ID: e6ad013148663f523fc75457f2c879485ba6847c398b00b8859e48f911a91f0f
Opcode Fuzzy Hash: a39e61028d3f4c4838a31440bf5ce7b60a881add5d1fdf9b2c842a7c0df228f9
Instruction Fuzzy Hash: A6317275A41218BBEB306BB55C8AFBF7E6CFB45B50F100069FA00E61E1C6B06D41EA60

Function 00C11201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00C116C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C1170D
Part of subcall function 00C116C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C1173A
Part of subcall function 00C116C3: GetLastError.KERNEL32 ref: 00C1174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00C11286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00C112A8
CloseHandle.KERNEL32(?), ref: 00C112B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00C112D1
GetProcessWindowStation.USER32 ref: 00C112EA
SetProcessWindowStation.USER32(00000000), ref: 00C112F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00C11310

Part of subcall function 00C110BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C111FC), ref: 00C110D4
Part of subcall function 00C110BF: CloseHandle.KERNEL32(?,?,00C111FC), ref: 00C110E9

Strings

winsta0, xrefs: 00C112CC
, xrefs: 00C1125A
default, xrefs: 00C1130B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 145b26fa2e63cb786ba0edc9ecc8f9938bafa6ce43c40a373e638796ca8e34ee
Instruction ID: 8e976f47095fbc10ca37da522fc2286360b0a51f207509c5d33f1a873a062417
Opcode Fuzzy Hash: 145b26fa2e63cb786ba0edc9ecc8f9938bafa6ce43c40a373e638796ca8e34ee
Instruction Fuzzy Hash: 6981A271900209AFDF109FA4DC49FEE7BB9FF06704F184129FE20A61A0D7798A84DB61

Function 00C10B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C110F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C11114
Part of subcall function 00C110F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00C10B9B,?,?,?), ref: 00C11120
Part of subcall function 00C110F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00C10B9B,?,?,?), ref: 00C1112F
Part of subcall function 00C110F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00C10B9B,?,?,?), ref: 00C11136
Part of subcall function 00C110F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C1114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C10BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C10C00
GetLengthSid.ADVAPI32(?), ref: 00C10C17
GetAce.ADVAPI32(?,00000000,?), ref: 00C10C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C10C6D
GetLengthSid.ADVAPI32(?), ref: 00C10C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00C10C8C
HeapAlloc.KERNEL32(00000000), ref: 00C10C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C10CB4
CopySid.ADVAPI32(00000000), ref: 00C10CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C10CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C10D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C10D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C10D45
HeapFree.KERNEL32(00000000), ref: 00C10D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C10D55
HeapFree.KERNEL32(00000000), ref: 00C10D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C10D65
HeapFree.KERNEL32(00000000), ref: 00C10D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00C10D78
HeapFree.KERNEL32(00000000), ref: 00C10D7F

Part of subcall function 00C11193: GetProcessHeap.KERNEL32(00000008,00C10BB1,?,00000000,?,00C10BB1,?), ref: 00C111A1
Part of subcall function 00C11193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00C10BB1,?), ref: 00C111A8
Part of subcall function 00C11193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00C10BB1,?), ref: 00C111B7

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 2f490a36e63641514ba8421c201cd08c78572552bdbed593799bdd2d1ea729f9
Instruction ID: 75dcbdb2deb27b699557aad378725cb98d873e3367811db36c683a94e60e6ab5
Opcode Fuzzy Hash: 2f490a36e63641514ba8421c201cd08c78572552bdbed593799bdd2d1ea729f9
Instruction Fuzzy Hash: 1C717E7590120AABDF10DFA4DC84BEEBBB8BF06300F148515E914A61A1D7B5AA85DBA0

Function 00C2EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00C4CC08), ref: 00C2EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00C2EB37
GetClipboardData.USER32(0000000D), ref: 00C2EB43
CloseClipboard.USER32 ref: 00C2EB4F
GlobalLock.KERNEL32(00000000), ref: 00C2EB87
CloseClipboard.USER32 ref: 00C2EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00C2EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00C2EBC9
GetClipboardData.USER32(00000001), ref: 00C2EBD1
GlobalLock.KERNEL32(00000000), ref: 00C2EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00C2EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00C2EC38
GetClipboardData.USER32(0000000F), ref: 00C2EC44
GlobalLock.KERNEL32(00000000), ref: 00C2EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00C2EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00C2EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00C2ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00C2ECF3
CountClipboardFormats.USER32 ref: 00C2ED14
CloseClipboard.USER32 ref: 00C2ED59

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 33a942cf6b7902f653fadd89a0f3ddb8d7239d22040f7e20d5b53515f2479f7a
Instruction ID: 36193ca4cd80d6c99340e456361d9a29b66046f7f6031b649d55590950e9dd5d
Opcode Fuzzy Hash: 33a942cf6b7902f653fadd89a0f3ddb8d7239d22040f7e20d5b53515f2479f7a
Instruction Fuzzy Hash: 9A61BF342042019FD310EF24E885FBE7BE4BF85714F184559F856A76A2CBB1DE45CB62

Function 00C2698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C269BE
FindClose.KERNEL32(00000000), ref: 00C26A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C26A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C26A75

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00C26AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00C26ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 00C26B32
%02d, xrefs: 00C26C00, 00C26C0A, 00C26C5A, 00C26CAA, 00C26CFA, 00C26D4A
%4d, xrefs: 00C26BB1
%03d, xrefs: 00C26DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00C26B6A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: c2038c5fc4e133c97ce4f90d3bf8321f085263c6a8c41998b3f4a1858c1d679b
Instruction ID: c78b16351ad6b6b023709ca5d583934b3769f099c5671e9fafe7a77024051152
Opcode Fuzzy Hash: c2038c5fc4e133c97ce4f90d3bf8321f085263c6a8c41998b3f4a1858c1d679b
Instruction Fuzzy Hash: A2D14E72508300AFC714EBA4D891EBFB7ECAF88704F44495DF589D6191EBB4DA48CB62

Function 00C29642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00C29663
GetFileAttributesW.KERNEL32(?), ref: 00C296A1
SetFileAttributesW.KERNEL32(?,?), ref: 00C296BB
FindNextFileW.KERNEL32(00000000,?), ref: 00C296D3
FindClose.KERNEL32(00000000), ref: 00C296DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00C296FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00C2974A
SetCurrentDirectoryW.KERNEL32(00C76B7C), ref: 00C29768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C29772
FindClose.KERNEL32(00000000), ref: 00C2977F
FindClose.KERNEL32(00000000), ref: 00C2978F

Strings

*.*, xrefs: 00C296F5

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 2e8a4a69af8b780ca4d629518b3e25431957df8a6b2bb8a186ad25fd1b8d833c
Instruction ID: 79973da53a30c825208723e689243cb5a8a14950a7a78fd2aeb5881e2751c443
Opcode Fuzzy Hash: 2e8a4a69af8b780ca4d629518b3e25431957df8a6b2bb8a186ad25fd1b8d833c
Instruction Fuzzy Hash: 4031D5365016296BDB60EFB5EC49BDE77BCEF0A320F104166F915E21A0EB74DE448A14

Function 00C2979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00C297BE
FindNextFileW.KERNEL32(00000000,?), ref: 00C29819
FindClose.KERNEL32(00000000), ref: 00C29824
FindFirstFileW.KERNEL32(*.*,?), ref: 00C29840
SetCurrentDirectoryW.KERNEL32(?), ref: 00C29890
SetCurrentDirectoryW.KERNEL32(00C76B7C), ref: 00C298AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C298B8
FindClose.KERNEL32(00000000), ref: 00C298C5
FindClose.KERNEL32(00000000), ref: 00C298D5

Part of subcall function 00C1DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00C1DB00

Strings

*.*, xrefs: 00C2983B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 5a6fe00c87fb28633c3a046c46e39fb5c796e0ba7b85d4107ec37136561b759a
Instruction ID: 59dbbb366865751826e9c3beb31b622a0f27fe228dec6a996a5affcd9e1b4e3d
Opcode Fuzzy Hash: 5a6fe00c87fb28633c3a046c46e39fb5c796e0ba7b85d4107ec37136561b759a
Instruction Fuzzy Hash: 0D31D6355016296BDB24EFB5EC88BDE77BCEF07320F144166E924E21E1DB70DA44CA24

Function 00C3BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C3C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C3B6AE,?,?), ref: 00C3C9B5
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3C9F1
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3CA68
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C3BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00C3BFA9
RegCloseKey.ADVAPI32(00000000), ref: 00C3BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00C3C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00C3C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00C3C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00C3C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00C3C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00C3C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C3C382
RegCloseKey.ADVAPI32(00000000), ref: 00C3C38F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: bcfeda1c0443c96acc2701f508f6f2467936a17165c7ed4d1cd82afff9b51c9b
Instruction ID: 7a9439ed8fa502c411ee0a9a1af90faae0742da7e156738aaec36ebecd0f42c8
Opcode Fuzzy Hash: bcfeda1c0443c96acc2701f508f6f2467936a17165c7ed4d1cd82afff9b51c9b
Instruction Fuzzy Hash: 57025A71614200AFC714DF28C8D1E6ABBE5EF89308F18849DF85ADB2A2DB31ED45CB51

Function 00C28195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C28257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00C28267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00C28273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C28310
SetCurrentDirectoryW.KERNEL32(?), ref: 00C28324
SetCurrentDirectoryW.KERNEL32(?), ref: 00C28356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C2838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00C28395

Strings

*.*, xrefs: 00C2839B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 628ec36fd28e6faa6f32187136c21619fbd21573f64bc133c131b20cb4538f8a
Instruction ID: a27f08964f93cbc7aeda5f7c6a3affea2415cbe7aa72bf2eb7ac87e12459f5b0
Opcode Fuzzy Hash: 628ec36fd28e6faa6f32187136c21619fbd21573f64bc133c131b20cb4538f8a
Instruction Fuzzy Hash: BD618F725043159FC710EF64D840AAEB3E8FF89310F04895EF999C7261EB75E949CB92

Function 00C1D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BB3A97,?,?,00BB2E7F,?,?,?,00000000), ref: 00BB3AC2

Part of subcall function 00C1E199: GetFileAttributesW.KERNEL32(?,00C1CF95), ref: 00C1E19A

FindFirstFileW.KERNEL32(?,?), ref: 00C1D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00C1D1DD
MoveFileW.KERNEL32(?,?), ref: 00C1D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00C1D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C1D237

Part of subcall function 00C1D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00C1D21C,?,?), ref: 00C1D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00C1D253
FindClose.KERNEL32(00000000), ref: 00C1D264

Strings

\*.*, xrefs: 00C1D0CD, 00C1D0D6, 00C1D0EB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: b0be17fc0a34bb72cafcd921b2fcd0f393a13d0f78f9c84f1d8bba6da8e42c67
Instruction ID: f2c6b907a6fe04eb11c2cc9695ba42b026b4e4477ea720971a8360eeccf623b4
Opcode Fuzzy Hash: b0be17fc0a34bb72cafcd921b2fcd0f393a13d0f78f9c84f1d8bba6da8e42c67
Instruction Fuzzy Hash: 00614C3180110DABCF15EBE4DD92AFDB7B5AF16300F2441A5E412771A2EB70AF49EB61

Function 00C2ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00C2ED91
EmptyClipboard.USER32 ref: 00C2ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00C2EDAC
CloseClipboard.USER32 ref: 00C2EEA3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: bd02e964135344dd5acc104a393039db510fa01c14e21983ea7407b13c1c8176
Instruction ID: 8a45f15de67492ade3f9a344c53eb223a21085ec79ea0791b7675e1574b4db0f
Opcode Fuzzy Hash: bd02e964135344dd5acc104a393039db510fa01c14e21983ea7407b13c1c8176
Instruction Fuzzy Hash: A341BD35205621AFD320CF15E888B69BBE5FF45318F15C099E4299BB72C775ED41CB90

Function 00C1E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00C116C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C1170D
Part of subcall function 00C116C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C1173A
Part of subcall function 00C116C3: GetLastError.KERNEL32 ref: 00C1174A

ExitWindowsEx.USER32(?,00000000), ref: 00C1E932

Strings

SeShutdownPrivilege, xrefs: 00C1E902
@, xrefs: 00C1E925
, xrefs: 00C1E920
, xrefs: 00C1E95C

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 88aca2eb08c85d2cc700af018115e37e8d61eddb06460256e65630a4204a252b
Instruction ID: 0a08a7c762c50c260cd82cbd38b39ae68fa240cd94944e68809d6421fb879a68
Opcode Fuzzy Hash: 88aca2eb08c85d2cc700af018115e37e8d61eddb06460256e65630a4204a252b
Instruction Fuzzy Hash: F1014932A10311ABEB6422B59CC6FFF725CAB0A750F184422FD13E20E1D5A55DC0B2A0

Function 00C31204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00C31276
WSAGetLastError.WSOCK32 ref: 00C31283
bind.WSOCK32(00000000,?,00000010), ref: 00C312BA
WSAGetLastError.WSOCK32 ref: 00C312C5
closesocket.WSOCK32(00000000), ref: 00C312F4
listen.WSOCK32(00000000,00000005), ref: 00C31303
WSAGetLastError.WSOCK32 ref: 00C3130D
closesocket.WSOCK32(00000000), ref: 00C3133C

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: cd85aa78ef6e54d71b4f900fe084797f4eb11335b38cbe98d29727476a4a134f
Instruction ID: 93aeac77cc90433c16d95ed85085ccaf671056426310e24a294811fc4baaddbd
Opcode Fuzzy Hash: cd85aa78ef6e54d71b4f900fe084797f4eb11335b38cbe98d29727476a4a134f
Instruction Fuzzy Hash: DB417F35A001409FD710DF64C488B6ABBE5BF86318F188198E8669F2E7C771ED85CBE1

Function 00C1D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BB3A97,?,?,00BB2E7F,?,?,?,00000000), ref: 00BB3AC2

Part of subcall function 00C1E199: GetFileAttributesW.KERNEL32(?,00C1CF95), ref: 00C1E19A

FindFirstFileW.KERNEL32(?,?), ref: 00C1D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00C1D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C1D481
FindClose.KERNEL32(00000000), ref: 00C1D498
FindClose.KERNEL32(00000000), ref: 00C1D4A1

Strings

\*.*, xrefs: 00C1D3F2

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: c70c24e28b3169605bb878a7af529c1fdac0efd3144ef017072e348604d6a27e
Instruction ID: 439c5cb4ab946c749406b8f1cab3aa5227e16811e53ef528f032aad5f98d2d6f
Opcode Fuzzy Hash: c70c24e28b3169605bb878a7af529c1fdac0efd3144ef017072e348604d6a27e
Instruction Fuzzy Hash: 0B317031009341ABC314EF64D8919FF77E8BE96300F444A5DF4D2921A1EBA0EA49D763

Function 00BEE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BEE645

Strings

1#SNAN, xrefs: 00BEF844
1#IND, xrefs: 00BEF83D
1#INF, xrefs: 00BEF852
1#QNAN, xrefs: 00BEF84B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 13f4ddfcd36951c0da0520b5bad09ad6f87a84494ca038bf34ee8002872dc890
Instruction ID: 1531563f4103da3a10ef3d12b9cd104e4a3273b878d8c21ff17b997690b4ff58
Opcode Fuzzy Hash: 13f4ddfcd36951c0da0520b5bad09ad6f87a84494ca038bf34ee8002872dc890
Instruction Fuzzy Hash: 87C24971E046698FDB25CE29DD807EAB7F5EB48305F1441EAD81EE7241E774AE818F40

Function 00C2648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C264DC
CoInitialize.OLE32(00000000), ref: 00C26639
CoCreateInstance.OLE32(00C4FCF8,00000000,00000001,00C4FB68,?), ref: 00C26650
CoUninitialize.OLE32 ref: 00C268D4

Strings

.lnk, xrefs: 00C264BA, 00C26524, 00C265E0

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 88c116a728eb007deb69544b0e34bf7ea5b9ae516afb6bff508eacfd341d1dcf
Instruction ID: 5889b30ceaf7db09ad68060841de2fefb8e7c6da89519aa232172ac6c7366d3b
Opcode Fuzzy Hash: 88c116a728eb007deb69544b0e34bf7ea5b9ae516afb6bff508eacfd341d1dcf
Instruction Fuzzy Hash: A4D14B715083119FC314EF24C881AABB7E9FF94704F1049ADF5958B2A1EB70EE45CBA2

Function 00C322DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00C322E8

Part of subcall function 00C2E4EC: GetWindowRect.USER32(?,?), ref: 00C2E504

GetDesktopWindow.USER32 ref: 00C32312
GetWindowRect.USER32(00000000), ref: 00C32319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00C32355
GetCursorPos.USER32(?), ref: 00C32381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00C323DF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: e8ffcaada753ff2a39dd3d04495b639d7eeb25c7a1886a2e6f2dc17ab0a096e1
Instruction ID: de52f876ac869e482c79db9072629c3bb7019d38c8f193441407fce2352bb5df
Opcode Fuzzy Hash: e8ffcaada753ff2a39dd3d04495b639d7eeb25c7a1886a2e6f2dc17ab0a096e1
Instruction Fuzzy Hash: 8C31ED72505315ABDB60DF14D848B9FBBADFF85310F000919F995D71A1DB34EA08CB92

Function 00C29B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00C29B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00C29C8B

Part of subcall function 00C23874: GetInputState.USER32 ref: 00C238CB
Part of subcall function 00C23874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C23966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00C29BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00C29C75

Strings

*.*, xrefs: 00C29B5D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 77452d2f390a32d03cbc0f927d193397cfca9b91638fa112d7fa9cc3dd546b66
Instruction ID: bb4d88306147fafdcf2bd3da27038d209141ab8a230112827c99411235bdc76e
Opcode Fuzzy Hash: 77452d2f390a32d03cbc0f927d193397cfca9b91638fa112d7fa9cc3dd546b66
Instruction Fuzzy Hash: 5D41827190521AAFDF55DF64D885AEEBBF4FF05310F2440AAE815A21A1EB709F84CF60

Function 00BC997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00BC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BC9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00BC9A4E
GetSysColor.USER32(0000000F), ref: 00BC9B23
SetBkColor.GDI32(?,00000000), ref: 00BC9B36

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: fc992f29306e18c9f29f2be1de05e1764e27955cb962eb2437daa21bef48e63f
Instruction ID: 0e3c41a76dce99fa4b631301e37680348d445f5c766a92d4bf0fd087c1883574
Opcode Fuzzy Hash: fc992f29306e18c9f29f2be1de05e1764e27955cb962eb2437daa21bef48e63f
Instruction Fuzzy Hash: CAA10371608454BEF729AB2C8C8DF7F2ADDEB42340F15028DF512D66D1CA26AE01D776

Function 00C31806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C3304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C3307A
Part of subcall function 00C3304E: _wcslen.LIBCMT ref: 00C3309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00C3185D
WSAGetLastError.WSOCK32 ref: 00C31884
bind.WSOCK32(00000000,?,00000010), ref: 00C318DB
WSAGetLastError.WSOCK32 ref: 00C318E6
closesocket.WSOCK32(00000000), ref: 00C31915

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 269b4dcb92fa6edaa00331c5600f06126d5081d0aaf6da8ca279f432887ad2de
Instruction ID: bac82ac43ff3fe4e3a92a787e62df03254a4909693df08dac3927c4c434f2c86
Opcode Fuzzy Hash: 269b4dcb92fa6edaa00331c5600f06126d5081d0aaf6da8ca279f432887ad2de
Instruction Fuzzy Hash: F3519175A10200AFDB10AF24C886F7A77E5AB45718F08809CF9169F3D3CB75AD41CBA1

Function 00C41C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00C41CC0
IsWindowEnabled.USER32 ref: 00C41CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00C41CDB
IsIconic.USER32 ref: 00C41CE9
IsZoomed.USER32 ref: 00C41CF7

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 4a8b68ee54663de067c3a26a56952dc21dfe30b6d60b32fe785746d3d7ac889b
Instruction ID: 7614daaad57a5a8732a6d9985eb144ff5d791a58f6ac8c099848999838dd32a4
Opcode Fuzzy Hash: 4a8b68ee54663de067c3a26a56952dc21dfe30b6d60b32fe785746d3d7ac889b
Instruction Fuzzy Hash: F3219F357412115FD7218F2ADCC4B6A7BE5FF85325B1D8068EC9A8B252CB71ED82CB90

Function 00BB8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00BF5DF0
ERCP, xrefs: 00BB813C
VUUU, xrefs: 00BB83FA
VUUU, xrefs: 00BB843C
VUUU, xrefs: 00BB83E8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: d7890dfb5e8839d0e2c51db041e0c6f0cdacd22af3a98b5b4dc632e9ff060812
Instruction ID: b3fb9401c266dd417fb9d92ee805a338d3ef67587e448d2d47a4d4f817e84a6e
Opcode Fuzzy Hash: d7890dfb5e8839d0e2c51db041e0c6f0cdacd22af3a98b5b4dc632e9ff060812
Instruction Fuzzy Hash: 0DA24A70A0061ACBDF24CF58C9907FDB7F5EB54314F2481EAEA16A7285DBB09D85CB90

Function 00C3A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C3A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00C3A6BA

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00C3A79C
CloseHandle.KERNEL32(00000000), ref: 00C3A7AB

Part of subcall function 00BCCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00BF3303,?), ref: 00BCCE8A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 541f92fbcdab00f9e9ca4bb56d0e7e3042045fa60983bd26371f039a94f8ac5e
Instruction ID: b486493452528e7d982cad8ce5677bad1804d6dd687c935153d2bbcec3273d7e
Opcode Fuzzy Hash: 541f92fbcdab00f9e9ca4bb56d0e7e3042045fa60983bd26371f039a94f8ac5e
Instruction Fuzzy Hash: E9514AB1508300AFD714EF24C886AAFBBE8FF89754F00495DF599972A1EB70D904CB92

Function 00C1AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00C1AAAC
SetKeyboardState.USER32(00000080), ref: 00C1AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00C1AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00C1AB88

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d6d5c97741da1b213d3456536508fee9997e99c5145811eb19a81ab7e71eefba
Instruction ID: 041fb51e74a8964fa236968f1266cd26effa6d0890f8c24f7f55c9e8db96d5ff
Opcode Fuzzy Hash: d6d5c97741da1b213d3456536508fee9997e99c5145811eb19a81ab7e71eefba
Instruction Fuzzy Hash: 28312870A46288AFFB34CA65CC05BFE7BA6AF47310F04821AF091521E1D3758AC1F762

Function 00BEBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BEBB7F

Part of subcall function 00BE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000), ref: 00BE29DE
Part of subcall function 00BE29C8: GetLastError.KERNEL32(00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000,00000000), ref: 00BE29F0

GetTimeZoneInformation.KERNEL32 ref: 00BEBB91
WideCharToMultiByte.KERNEL32(00000000,?,00C8121C,000000FF,?,0000003F,?,?), ref: 00BEBC09
WideCharToMultiByte.KERNEL32(00000000,?,00C81270,000000FF,?,0000003F,?,?,?,00C8121C,000000FF,?,0000003F,?,?), ref: 00BEBC36

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: a915bc77924180666c48e056ecc3cd0587784bcef7b7feea95442a32cc3de6b8
Instruction ID: 8c435844d1535da7b7074db92acfaf9680ccf81a39e30372298158a3ab4a91b8
Opcode Fuzzy Hash: a915bc77924180666c48e056ecc3cd0587784bcef7b7feea95442a32cc3de6b8
Instruction Fuzzy Hash: 9231A071908285DFCB15DF6ADC81E6EBBF8FF46320B2842AAE450D72A1D7309D02CB54

Function 00C2CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00C2CE89
GetLastError.KERNEL32(?,00000000), ref: 00C2CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00C2CEFE

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 82bd4ea299d9e6f289d5e9c8636bb7d53ad5b6d991805f5af6257aca1cbb1aa7
Instruction ID: 3927a980985595e5e9e9c3ab21e581d856a3da0c09814c70cc37182b4c39b0b5
Opcode Fuzzy Hash: 82bd4ea299d9e6f289d5e9c8636bb7d53ad5b6d991805f5af6257aca1cbb1aa7
Instruction Fuzzy Hash: A521AFB15007159BDB30DFA5E988BABBBFCEB50358F10441EE556D2561EB70EE048B50

Function 00C18298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00C182AA

Strings

|, xrefs: 00C182DA
(, xrefs: 00C182F0

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 7f7e1b342e54a82f9ad0e68d1657186adb1db176b87799100365f49815f1f0e4
Instruction ID: aa5b4ecc7816819e023a0350bf2bbe48cda2a6ed215016da8a1de94cc14f6d16
Opcode Fuzzy Hash: 7f7e1b342e54a82f9ad0e68d1657186adb1db176b87799100365f49815f1f0e4
Instruction Fuzzy Hash: 0C323874A047059FCB28CF59C081AAAB7F0FF48710B55C56EE5AADB3A1DB70E981DB40

Function 00C25C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C25CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00C25D17
FindClose.KERNEL32(?), ref: 00C25D5F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 8c63ef7a607ba7075d9310c46d4f49fd77553521d20663d1f76645ddc81e3268
Instruction ID: fb1f41bbf40cd54b56a645af3bf6cb5ca1ea7f066aabbb93dded152730c3df9f
Opcode Fuzzy Hash: 8c63ef7a607ba7075d9310c46d4f49fd77553521d20663d1f76645ddc81e3268
Instruction Fuzzy Hash: AC519A74604A019FC714CF28D494EAAB7E4FF49314F14859EE96A8B3A2DB70ED05CF91

Function 00BE2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00BE271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BE2724
UnhandledExceptionFilter.KERNEL32(?), ref: 00BE2731

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0f07bbc41ecd2fe740f0a5e3fb4a978af965f04439617a44d767ed63f4c0153c
Instruction ID: be6561e46d23e12d17676e07a6283c24984badadaec6a90f7f978fd22adc66dc
Opcode Fuzzy Hash: 0f07bbc41ecd2fe740f0a5e3fb4a978af965f04439617a44d767ed63f4c0153c
Instruction Fuzzy Hash: 2631B274911218ABCB21DF69DC897DDBBF8BF08310F5041EAE81CA6261E7709F818F45

Function 00C251CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C251DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00C25238
SetErrorMode.KERNEL32(00000000), ref: 00C252A1

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: e958e1ba675297f75f9920452490037a572d4227c361155332559056bfe61257
Instruction ID: 01c166eabc62238f1a020c7f65bd593b72f0c5dad98ff2a6a47ce487902e11f8
Opcode Fuzzy Hash: e958e1ba675297f75f9920452490037a572d4227c361155332559056bfe61257
Instruction Fuzzy Hash: 99311A75A00518DFDB00DF54D884BAEBBB4FF49314F148099E909AB3A2DB71E955CB90

Function 00C116C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00BCFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00BD0668
Part of subcall function 00BCFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00BD0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C1170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C1173A
GetLastError.KERNEL32 ref: 00C1174A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 1565dbff03a9b849e6474e37815aed97f5668001fd81aab5f91f9f21143d29ec
Instruction ID: 76fb045778a52e80540d5f410e791556c53ea2da883d136528007ca824c45b54
Opcode Fuzzy Hash: 1565dbff03a9b849e6474e37815aed97f5668001fd81aab5f91f9f21143d29ec
Instruction Fuzzy Hash: 6D11CEB2410305AFD718AF54DCC6EAAB7F9FB05714B24856EF46653291EB70BC818A60

Function 00C1D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00C1D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00C1D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00C1D650

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 7beb529ef95f39678997048b1da962d680e6082fe214f1eb96c80f92e294a6bd
Instruction ID: fe6cc275fd8ec3c0823991baa0742ed57be63b18dbd8fba567aebbdacc1b8efc
Opcode Fuzzy Hash: 7beb529ef95f39678997048b1da962d680e6082fe214f1eb96c80f92e294a6bd
Instruction Fuzzy Hash: FE118E75E01228BFDB208F95DC84FEFBBBCEB46B60F108111F914E7290C2B05A018BA1

Function 00C11663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00C1168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00C116A1
FreeSid.ADVAPI32(?), ref: 00C116B1

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 424416e951ac1cd27fa36583e44c5bbcad241c6ca5fda8fcd175860d4afb9a3b
Instruction ID: b9158ec4a41c6a4a75cb0ac4c5d20e1b2db755b14cbdfbe72e695fd8a5c3a22e
Opcode Fuzzy Hash: 424416e951ac1cd27fa36583e44c5bbcad241c6ca5fda8fcd175860d4afb9a3b
Instruction Fuzzy Hash: 3DF04475A41308FBDB00CFE0CC89AAEBBBCFB08200F004860E900E2190E334AA448A50

Function 00BD4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00BE28E9,?,00BD4CBE,00BE28E9,00C788B8,0000000C,00BD4E15,00BE28E9,00000002,00000000,?,00BE28E9), ref: 00BD4D09
TerminateProcess.KERNEL32(00000000,?,00BD4CBE,00BE28E9,00C788B8,0000000C,00BD4E15,00BE28E9,00000002,00000000,?,00BE28E9), ref: 00BD4D10
ExitProcess.KERNEL32 ref: 00BD4D22

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 72202a91fa76d955df75a8055d7793cba8590d5808edc35156cd940d0077ff5f
Instruction ID: 8eebb52858a3a9b7921cb328bc0f15b76a8f909abef51c582dc33b81d0cd11cc
Opcode Fuzzy Hash: 72202a91fa76d955df75a8055d7793cba8590d5808edc35156cd940d0077ff5f
Instruction Fuzzy Hash: 9BE0B635001188AFCF61AF64DD49B9C7BAAFB42791B144065FC058B232DB35DD42CB80

Function 00C0D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00C0D28C

Strings

X64, xrefs: 00C0D2A8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: f1fb3aa2d72a7d0d8c6986f363cc459d514679b69b2824abf6d609445d453751
Instruction ID: dbb1ceba4ba3d6041ea186c2373e4ab8f4754203d267381a8b7ed3ba81198d63
Opcode Fuzzy Hash: f1fb3aa2d72a7d0d8c6986f363cc459d514679b69b2824abf6d609445d453751
Instruction Fuzzy Hash: 20D0C9B880211DEBCB90CB90DCC8EDDB7BCBB04305F100195F106A2040D73095488F10

Function 00BDCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: aed7b40f69b28664e3031fe8a2a5c3efcf62623ceea75bad6cb5ce5e230557ab
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: C6022D71E0011A9BDF14CFA9C9806ADFBF1EF48314F2582AAD919E7384E731AD45CB84

Function 00C268EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C26918
FindClose.KERNEL32(00000000), ref: 00C26961

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 239260eaf503dd15cb0ea456e6483d01d67e550c7320be4730a2f55ae3a23971
Instruction ID: fe324fbaa950ca6cf01dd9f1195aecfb2c1d764eede6f6049238229004ed36c4
Opcode Fuzzy Hash: 239260eaf503dd15cb0ea456e6483d01d67e550c7320be4730a2f55ae3a23971
Instruction Fuzzy Hash: 5D1190356046109FC710DF2AD485A2ABBE5FF85328F14C699F4698F7A2CB70EC45CBA1

Function 00C237B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00C34891,?,?,00000035,?), ref: 00C237E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00C34891,?,?,00000035,?), ref: 00C237F4

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 8d7f335517b53240d3cb4fefa586eb194504209c9636ccfca9eadbee3315dd36
Instruction ID: e11a23ce7d80de39b42114467fe9e1802691bee1bc7d8437e645e56a76911e57
Opcode Fuzzy Hash: 8d7f335517b53240d3cb4fefa586eb194504209c9636ccfca9eadbee3315dd36
Instruction Fuzzy Hash: D3F0EC746052286BDB6017665C8DFEF3A9DEFC5B61F000165F505D21D1D5A05944C6B0

Function 00C1B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00C1B25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00C1B270

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: ee9cd76912904c08c472872cc4e773c2f20e5ecdb836cbba6681a54f2aa5ccfd
Instruction ID: 23a58bc829eb006d3e76882d8c8bcf23a7ded2c859cb92ecede1b3ffa1f559be
Opcode Fuzzy Hash: ee9cd76912904c08c472872cc4e773c2f20e5ecdb836cbba6681a54f2aa5ccfd
Instruction Fuzzy Hash: B1F06D7480424EABDB058FA0C805BEE7BB0FF05305F008009F961A51A2C37986059F94

Function 00C110BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C111FC), ref: 00C110D4
CloseHandle.KERNEL32(?,?,00C111FC), ref: 00C110E9

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 1bedbf34242715c33f088113fb9198043109ff9dafb8b8459969c9638d2d1984
Instruction ID: 1efc9ce4b84ba045d72dc36065d8a2c6313a071e71ce48d477e1bdd02b9f5f33
Opcode Fuzzy Hash: 1bedbf34242715c33f088113fb9198043109ff9dafb8b8459969c9638d2d1984
Instruction Fuzzy Hash: 15E04F32005611AEE7252B11FC05FB777E9FB05320B14886DF5A6804B1DB626C90DB10

Function 00BBCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00C00C40

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 81475664843c6f5bfb3b63b030d2a2b59cb63821cf6d73e262c031561590fa6b
Instruction ID: b2e5ab7ae2cf59c6dd8fe709085b0bd8f81fbf516b584e33bc3d67828818eb5a
Opcode Fuzzy Hash: 81475664843c6f5bfb3b63b030d2a2b59cb63821cf6d73e262c031561590fa6b
Instruction Fuzzy Hash: 7B3247749002189BDF14DF90C895BFDBBF5FF05304F2440A9E816AB292D7B5AE49CB61

Function 00BE676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00BE6766,?,?,00000008,?,?,00BEFEFE,00000000), ref: 00BE6998

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a0f781a3ae65a4293d553ed2fba2cea10a923cbace9ddf12028def2c5314d4ee
Instruction ID: ad28eeff11b98ce35cd0b9c970c89d731711209353838953ab4efad5873f237d
Opcode Fuzzy Hash: a0f781a3ae65a4293d553ed2fba2cea10a923cbace9ddf12028def2c5314d4ee
Instruction Fuzzy Hash: D2B16B35610648DFD719CF29C48AB657BE0FF153A4F25C699E89ACF2A2C335E981CB40

Function 00BCB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00C0851F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 06aa025718ef20e7a31950f455dc30920259b0cef196914ea1cb5ef031291230
Instruction ID: b1c28e584a184727e6403c69cd12f26be66c378bb114f8ab961c4dfbfa6832d5
Opcode Fuzzy Hash: 06aa025718ef20e7a31950f455dc30920259b0cef196914ea1cb5ef031291230
Instruction Fuzzy Hash: FF124F759002299BDB24CF58C881BEEB7F5FF48710F14819AE849EB295DB309E85CF90

Function 00C2EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00C2EABD

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: bc5123775933517ad18b995a1a7604cfbe0780abd30eb02b202254ff83ba1e86
Instruction ID: 228c94796f56c712027270858fd6a0fa39a592590dc296380d73c7e657c1be27
Opcode Fuzzy Hash: bc5123775933517ad18b995a1a7604cfbe0780abd30eb02b202254ff83ba1e86
Instruction Fuzzy Hash: ADE012352102149FC710EF59D454E9ABBE9AF69760F00845AFC49D7251D6B0E8408B91

Function 00BD09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00BD03EE), ref: 00BD09DA

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 00b6c5e4cbcc72b81b109f071d99a2c5ce801cf7f5421c57191e0c9937331713
Instruction ID: 8a9dc058d32108de3f7b16ae0f30eba50d98cbf8abaf9784493dd6d8daa9629d
Opcode Fuzzy Hash: 00b6c5e4cbcc72b81b109f071d99a2c5ce801cf7f5421c57191e0c9937331713
Instruction Fuzzy Hash:

Function 00BD781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00BD798B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: e35f7b1dac1c9f016bb0ab6b49f3d39bde6e511407c8a06dfa5064055076acf4
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: E25137726CC6456ADB38852A48ADBFEE7D5DB02300F1805CBD886C7382FE1ADE01E355

Function 00BE6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55a63223dc1f34b4e98d68fd8ffe293eb184768b7f0c8e63f16c5487e86f5cb
Instruction ID: cffa514df5c9b916a7003fbcc72b226757e63fd68f6c44a1e92f57e8b4ec84b8
Opcode Fuzzy Hash: c55a63223dc1f34b4e98d68fd8ffe293eb184768b7f0c8e63f16c5487e86f5cb
Instruction Fuzzy Hash: 67322326D69F414DD7239635D822339A2D9EFB73C6F24C727E81AB5AA5EF29C4C34100

Function 00BCCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f06cb89b90d499f15dbd3d84718b088e9f3ba9d4fd4d812b9b3db44aa3942de
Instruction ID: e7a1978babbc8bc9ec4b07f66a929ecca2c577afb561f3ab7ba0d4b8d4bcb59c
Opcode Fuzzy Hash: 3f06cb89b90d499f15dbd3d84718b088e9f3ba9d4fd4d812b9b3db44aa3942de
Instruction Fuzzy Hash: 3A32F731A041558BDF24CF29C4D4B7E7BE1EB55310F28866AE4AEDB2D2D234DE81EB41

Function 00BB7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84163920b758e6c875597e24d3cab51dbafb686e88e7b809c5d56e9fdd873f7
Instruction ID: 082fbf802f00662479a3b57ce7b6efaf702fe22ea355a22b6c16295a93cb3903
Opcode Fuzzy Hash: c84163920b758e6c875597e24d3cab51dbafb686e88e7b809c5d56e9fdd873f7
Instruction Fuzzy Hash: B822A070A0460A9FDF24CF68C881BFEB7F6FF44300F2045A9E916A7291EB75A955CB50

Function 00BB91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f300db1b93a7fa038a7c1123c4cbe276d68e4605aaaa284e040188a38c9131
Instruction ID: b16bf70c5e16731d38ef8ca5e43f7ce672041dc1c15243fc8d8dc9b2b499c2aa
Opcode Fuzzy Hash: f7f300db1b93a7fa038a7c1123c4cbe276d68e4605aaaa284e040188a38c9131
Instruction Fuzzy Hash: 4202A6B0E0020AEBDB04DF54D881BBDB7F1FF44300F1081A9E9169B2A1E771EA55DB91

Function 00BE9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d7119f5b14f0d2a369446a16630510bf9d9ed65612ee048e137163eab622db
Instruction ID: 138e2732548095e219fa18752b64559d4a57563e63ae39f5df774af2a0afc817
Opcode Fuzzy Hash: e5d7119f5b14f0d2a369446a16630510bf9d9ed65612ee048e137163eab622db
Instruction Fuzzy Hash: 5DB1E224D2AF804DD3239639883133AB69CAFBB6D6F91D71BFC1674D62EB2185C34140

Function 00BD1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 36f206a6f367e2b67d14590aa5f5254196108062f89b3184612eebfdf07fe49d
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 589147726090A35ADB29463E857407DFFE1DA923A131A0FEFD4F2CA2C5FE149954D620

Function 00BD1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 1b08bbcf942878a869719c4e7f9c4786fe29dd04851fcdd5b42047b25e702d58
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 2C9143726090E349EB6D433D857403EFEE19AA23A131A47DFE4F2DB2C5FE248554E620

Function 00BD19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 560e61a9f874e7cffd5bcb729b53e87e1ff9f6ce1ceded687a27fbd9baf5271b
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: D29144722090A35ADB2D467E857403EFFE1DA923A231A0BDFD4F2CA2C5FE24D555D620

Function 00BD7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9062b0d2752ccbb66c243f8a1b01049a63cf6cd46d15330e6ed11371c627022a
Instruction ID: ddf09ff4f9e81d4b76653066efa67ede707619602b5f3438e6c2b2ffe8d0a1f8
Opcode Fuzzy Hash: 9062b0d2752ccbb66c243f8a1b01049a63cf6cd46d15330e6ed11371c627022a
Instruction Fuzzy Hash: 766148712D870A56DA389A288DB6BFEE3D4DF41700F1409DBE846DB381FE159E428359

Function 00BD7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49c05de0f89dda46275b61a2c70282b3872f710f8d32701bd0ca9f2ad3f0c14
Instruction ID: 26f0095acba632e371734e654046a66a28f24172473c1e54d180463baf9309f2
Opcode Fuzzy Hash: d49c05de0f89dda46275b61a2c70282b3872f710f8d32701bd0ca9f2ad3f0c14
Instruction Fuzzy Hash: F76129A16C870957DA389A288895BFEE3DADF41704F1409FBE943DB381FE11ED428355

Function 00BD1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: e0e677061e122147865a818d035b1a2e76fc8f12284a124fba163da82efa0297
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 5E8166726090A319DB6D867D857443EFFE19A923A131A0BDFD4F2CA2D1FE248954E620

Function 00C22046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2297c628d5ad7fb5cd13e84f000604ba9aa5ebb4324e1ed8a552b9e77311304
Instruction ID: fc9f6930b333595804f6b8bc37487cfc6eb64ab3915610a294fbaea270ac9a05
Opcode Fuzzy Hash: c2297c628d5ad7fb5cd13e84f000604ba9aa5ebb4324e1ed8a552b9e77311304
Instruction Fuzzy Hash: D121A5326206218BDB28CE79C82677E73E5A754310F25862EE4A7C77D0DE35A904CB84

Function 00C32ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C32B30
DeleteObject.GDI32(00000000), ref: 00C32B43
DestroyWindow.USER32 ref: 00C32B52
GetDesktopWindow.USER32 ref: 00C32B6D
GetWindowRect.USER32(00000000), ref: 00C32B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00C32CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00C32CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C32CF8
GetClientRect.USER32(00000000,?), ref: 00C32D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00C32D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C32D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C32D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C32D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C32D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C32D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C32DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C32DA8
GlobalFree.KERNEL32(00000000), ref: 00C32DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C32DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00C4FC38,00000000), ref: 00C32DDB
GlobalFree.KERNEL32(00000000), ref: 00C32DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00C32E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00C32E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C32E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C3303F

Strings

AutoIt v3, xrefs: 00C32CF2
static, xrefs: 00C32D3A, 00C32E91
DISPLAY, xrefs: 00C32EA2
, xrefs: 00C32FC5

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: e656bd8e66e3a843d104741a2033116d6de9d9309eba5f57b950243cefedfbd6
Instruction ID: 3196c345f8607ae08a785e0aba4569ced6599fd6f4450bde6416b7e3bde472d3
Opcode Fuzzy Hash: e656bd8e66e3a843d104741a2033116d6de9d9309eba5f57b950243cefedfbd6
Instruction Fuzzy Hash: 8D025875A10218AFDB14DFA4CC89FAE7BB9FB49710F048158F915AB2A1DB74ED01CB60

Function 00C470D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00C4712F
GetSysColorBrush.USER32(0000000F), ref: 00C47160
GetSysColor.USER32(0000000F), ref: 00C4716C
SetBkColor.GDI32(?,000000FF), ref: 00C47186
SelectObject.GDI32(?,?), ref: 00C47195
InflateRect.USER32(?,000000FF,000000FF), ref: 00C471C0
GetSysColor.USER32(00000010), ref: 00C471C8
CreateSolidBrush.GDI32(00000000), ref: 00C471CF
FrameRect.USER32(?,?,00000000), ref: 00C471DE
DeleteObject.GDI32(00000000), ref: 00C471E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00C47230
FillRect.USER32(?,?,?), ref: 00C47262
GetWindowLongW.USER32(?,000000F0), ref: 00C47284

Part of subcall function 00C473E8: GetSysColor.USER32(00000012), ref: 00C47421
Part of subcall function 00C473E8: SetTextColor.GDI32(?,?), ref: 00C47425
Part of subcall function 00C473E8: GetSysColorBrush.USER32(0000000F), ref: 00C4743B
Part of subcall function 00C473E8: GetSysColor.USER32(0000000F), ref: 00C47446
Part of subcall function 00C473E8: GetSysColor.USER32(00000011), ref: 00C47463
Part of subcall function 00C473E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C47471
Part of subcall function 00C473E8: SelectObject.GDI32(?,00000000), ref: 00C47482
Part of subcall function 00C473E8: SetBkColor.GDI32(?,00000000), ref: 00C4748B
Part of subcall function 00C473E8: SelectObject.GDI32(?,?), ref: 00C47498
Part of subcall function 00C473E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00C474B7
Part of subcall function 00C473E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C474CE
Part of subcall function 00C473E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00C474DB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: ea568d1b42490e7c9775165fcdefee13adb977a24df452c642e2176e701a0f79
Instruction ID: a139c6bdccef6f4a2100ff6fa6726345efb4818b965bf1d7504f127694d8e68c
Opcode Fuzzy Hash: ea568d1b42490e7c9775165fcdefee13adb977a24df452c642e2176e701a0f79
Instruction Fuzzy Hash: 87A17C76009301EFDB509F60DC88B6F7BA9FB8A320F100B19F962A61B1D771E944DB91

Function 00BC8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00BC8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00C06AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00C06AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00C06F43

Part of subcall function 00BC8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BC8BE8,?,00000000,?,?,?,?,00BC8BBA,00000000,?), ref: 00BC8FC5

SendMessageW.USER32(?,00001053), ref: 00C06F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00C06F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00C06FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00C06FB7

Strings

0, xrefs: 00C06DCF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 82fcc3e93e2b305d0b4924d29d962ff32174740dfedd50a37806a010e9972e0e
Instruction ID: d5d163233f84ee51da57e43b671628563d01cf46dc644352380339c511bdeae5
Opcode Fuzzy Hash: 82fcc3e93e2b305d0b4924d29d962ff32174740dfedd50a37806a010e9972e0e
Instruction Fuzzy Hash: FD129E34601212EFDB25CF24C894BA9B7F5FB45310F1844ADF4A58B2A2CB31ED62DB91

Function 00C32711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00C3273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00C3286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00C328A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00C328B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00C32900
GetClientRect.USER32(00000000,?), ref: 00C3290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00C32955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00C32964
GetStockObject.GDI32(00000011), ref: 00C32974
SelectObject.GDI32(00000000,00000000), ref: 00C32978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00C32988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C32991
DeleteDC.GDI32(00000000), ref: 00C3299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00C329C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00C329DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00C32A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00C32A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00C32A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00C32A77
GetStockObject.GDI32(00000011), ref: 00C32A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00C32A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00C32A97

Strings

AutoIt v3, xrefs: 00C328F8
static, xrefs: 00C3294F, 00C32A71
DISPLAY, xrefs: 00C3295A
msctls_progress32, xrefs: 00C32A13

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 0c80a60b038bfc82cd3168135eb5d6a40c44b582b43fd84d6baec81ac036cf80
Instruction ID: 65875e0a790a4aca6d1ea90ca4473ec56aeea7557675546545aea0c67b1e3cc3
Opcode Fuzzy Hash: 0c80a60b038bfc82cd3168135eb5d6a40c44b582b43fd84d6baec81ac036cf80
Instruction Fuzzy Hash: E2B17E75A10215AFEB14DF68CC85FAE7BA9FB09710F008554F915E72A0D770ED00CBA4

Function 00C24ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C24AED
GetDriveTypeW.KERNEL32(?,00C4CB68,?,\\.\,00C4CC08), ref: 00C24BCA
SetErrorMode.KERNEL32(00000000,00C4CB68,?,\\.\,00C4CC08), ref: 00C24D36

Strings

Fixed, xrefs: 00C24C09
ATA, xrefs: 00C24C98
Virtual, xrefs: 00C24CE5
SSD, xrefs: 00C24C4A
ATAPI, xrefs: 00C24C91
PhysicalDrive, xrefs: 00C24B76
\\.\, xrefs: 00C24B3F
1394, xrefs: 00C24C9F
Network, xrefs: 00C24C02
CDROM, xrefs: 00C24BFB
MMC, xrefs: 00C24CDE
USB, xrefs: 00C24CB4
SAS, xrefs: 00C24CC9
SSA, xrefs: 00C24CA6
RAMDisk, xrefs: 00C24BF4
Fibre, xrefs: 00C24CAD
Unknown, xrefs: 00C24BED, 00C24C83
RAID, xrefs: 00C24CBB
FileBackedVirtual, xrefs: 00C24CEC
SATA, xrefs: 00C24CD0
SCSI, xrefs: 00C24C8A
Removable, xrefs: 00C24C10, 00C24C15
iSCSI, xrefs: 00C24CC2

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 2a785af1842c5a516483aa561910be9f813521d610c9951737d08b63265ccd0b
Instruction ID: f465a26780d699d09dd7f587535a9799851b9796f3a32258a0dc2b9487dbdda1
Opcode Fuzzy Hash: 2a785af1842c5a516483aa561910be9f813521d610c9951737d08b63265ccd0b
Instruction Fuzzy Hash: F261C330605616DBCB1DDF2DEA82DBD77A0EB14340B248466F80AABA92DB71DE41DB41

Function 00C473E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00C47421
SetTextColor.GDI32(?,?), ref: 00C47425
GetSysColorBrush.USER32(0000000F), ref: 00C4743B
GetSysColor.USER32(0000000F), ref: 00C47446
CreateSolidBrush.GDI32(?), ref: 00C4744B
GetSysColor.USER32(00000011), ref: 00C47463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C47471
SelectObject.GDI32(?,00000000), ref: 00C47482
SetBkColor.GDI32(?,00000000), ref: 00C4748B
SelectObject.GDI32(?,?), ref: 00C47498
InflateRect.USER32(?,000000FF,000000FF), ref: 00C474B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C474CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00C474DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C4752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00C47554
InflateRect.USER32(?,000000FD,000000FD), ref: 00C47572
DrawFocusRect.USER32(?,?), ref: 00C4757D
GetSysColor.USER32(00000011), ref: 00C4758E
SetTextColor.GDI32(?,00000000), ref: 00C47596
DrawTextW.USER32(?,00C470F5,000000FF,?,00000000), ref: 00C475A8
SelectObject.GDI32(?,?), ref: 00C475BF
DeleteObject.GDI32(?), ref: 00C475CA
SelectObject.GDI32(?,?), ref: 00C475D0
DeleteObject.GDI32(?), ref: 00C475D5
SetTextColor.GDI32(?,?), ref: 00C475DB
SetBkColor.GDI32(?,?), ref: 00C475E5

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 94cf441074f0ac2b3d85b81557316434da8bddcff6821781a7fd77eb41e7b037
Instruction ID: 2117c526760f7288654135af705afc6a142b2a8926615702f2702a9c74c64dbc
Opcode Fuzzy Hash: 94cf441074f0ac2b3d85b81557316434da8bddcff6821781a7fd77eb41e7b037
Instruction Fuzzy Hash: A9616976901218AFDB019FA4DC89BAEBFB9FB09320F114215F915BB2A1D7749A40DF90

Function 00C40FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C41128
GetDesktopWindow.USER32 ref: 00C4113D
GetWindowRect.USER32(00000000), ref: 00C41144
GetWindowLongW.USER32(?,000000F0), ref: 00C41199
DestroyWindow.USER32(?), ref: 00C411B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00C411ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C4120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C4121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00C41232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00C41245
IsWindowVisible.USER32(00000000), ref: 00C412A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00C412BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00C412D0
GetWindowRect.USER32(00000000,?), ref: 00C412E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00C4130E
GetMonitorInfoW.USER32(00000000,?), ref: 00C41328
CopyRect.USER32(?,?), ref: 00C4133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00C413AA

Strings

tooltips_class32, xrefs: 00C411E6
0, xrefs: 00C410D3
(, xrefs: 00C4131B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: d9f1ca9782618ca9b4bfef95214b923b4534766dfd0e03c5925438e3b3bda1cb
Instruction ID: 8f601213a2e4952ac4eb6234262d0114c615f4322605b2fce315753214d5f600
Opcode Fuzzy Hash: d9f1ca9782618ca9b4bfef95214b923b4534766dfd0e03c5925438e3b3bda1cb
Instruction Fuzzy Hash: 43B19C71604341AFD714DF64C884BAEBBE4FF85350F04895CF9999B2A1CB71E984CB92

Function 00BC8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BC8968
GetSystemMetrics.USER32(00000007), ref: 00BC8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BC899B
GetSystemMetrics.USER32(00000008), ref: 00BC89A3
GetSystemMetrics.USER32(00000004), ref: 00BC89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00BC89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00BC89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00BC8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00BC8A3C
GetClientRect.USER32(00000000,000000FF), ref: 00BC8A5A
GetStockObject.GDI32(00000011), ref: 00BC8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BC8A81

Part of subcall function 00BC912D: GetCursorPos.USER32(?), ref: 00BC9141
Part of subcall function 00BC912D: ScreenToClient.USER32(00000000,?), ref: 00BC915E
Part of subcall function 00BC912D: GetAsyncKeyState.USER32(00000001), ref: 00BC9183
Part of subcall function 00BC912D: GetAsyncKeyState.USER32(00000002), ref: 00BC919D

SetTimer.USER32(00000000,00000000,00000028,00BC90FC), ref: 00BC8AA8

Strings

AutoIt v3 GUI, xrefs: 00BC8A20

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: fdac6c021a11b7c44d80ce2c0d19de4f6881de2a3072919df28a0c7792f742e6
Instruction ID: faf93f4588e04ade0000172cc2796f8f0a0b98a295d4ad7ec296af9bcdd8fbff
Opcode Fuzzy Hash: fdac6c021a11b7c44d80ce2c0d19de4f6881de2a3072919df28a0c7792f742e6
Instruction Fuzzy Hash: 4BB19A35A0020AAFDB14DFA8CC85FAE3BF5FB48314F054269FA15A72E0CB74A941CB54

Function 00C10D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C110F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C11114
Part of subcall function 00C110F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00C10B9B,?,?,?), ref: 00C11120
Part of subcall function 00C110F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00C10B9B,?,?,?), ref: 00C1112F
Part of subcall function 00C110F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00C10B9B,?,?,?), ref: 00C11136
Part of subcall function 00C110F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C1114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C10DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C10E29
GetLengthSid.ADVAPI32(?), ref: 00C10E40
GetAce.ADVAPI32(?,00000000,?), ref: 00C10E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C10E96
GetLengthSid.ADVAPI32(?), ref: 00C10EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00C10EB5
HeapAlloc.KERNEL32(00000000), ref: 00C10EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C10EDD
CopySid.ADVAPI32(00000000), ref: 00C10EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C10F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C10F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C10F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C10F6E
HeapFree.KERNEL32(00000000), ref: 00C10F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C10F7E
HeapFree.KERNEL32(00000000), ref: 00C10F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C10F8E
HeapFree.KERNEL32(00000000), ref: 00C10F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00C10FA1
HeapFree.KERNEL32(00000000), ref: 00C10FA8

Part of subcall function 00C11193: GetProcessHeap.KERNEL32(00000008,00C10BB1,?,00000000,?,00C10BB1,?), ref: 00C111A1
Part of subcall function 00C11193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00C10BB1,?), ref: 00C111A8
Part of subcall function 00C11193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00C10BB1,?), ref: 00C111B7

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 371a79236ce11e8cebcafa1b4109cb20d052396a733bac1aefe706e723fe5e49
Instruction ID: bdb91fd0ece923e353f30c776bf23b34ceebe0c726c00969c467a774f8653747
Opcode Fuzzy Hash: 371a79236ce11e8cebcafa1b4109cb20d052396a733bac1aefe706e723fe5e49
Instruction Fuzzy Hash: 01718D7290120AEBDF20DFA5DC45FEEBBB8BF06300F144115F929A61A1D7709A96DB60

Function 00C3C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C3C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00C4CC08,00000000,?,00000000,?,?), ref: 00C3C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00C3C5A4
_wcslen.LIBCMT ref: 00C3C5F4
_wcslen.LIBCMT ref: 00C3C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00C3C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00C3C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00C3C84D
RegCloseKey.ADVAPI32(?), ref: 00C3C881
RegCloseKey.ADVAPI32(00000000), ref: 00C3C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00C3C960

Strings

REG_MULTI_SZ, xrefs: 00C3C6F5
REG_BINARY, xrefs: 00C3C913
REG_SZ, xrefs: 00C3C644
REG_DWORD, xrefs: 00C3C804
REG_EXPAND_SZ, xrefs: 00C3C5CD
REG_QWORD, xrefs: 00C3C8C3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 786d39f7c62d28abc3986446b92fed6718b36609fc73d3c617cf27a980adabe3
Instruction ID: ba8857265aabc14cca2b0eedeec45929927d69624059751e628151a02bda1e07
Opcode Fuzzy Hash: 786d39f7c62d28abc3986446b92fed6718b36609fc73d3c617cf27a980adabe3
Instruction Fuzzy Hash: 0C1257356142019FC714DF24C891B6EB7E5EF88714F04889DF89AAB3A2DB71ED41CB91

Function 00C4091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C409C6
_wcslen.LIBCMT ref: 00C40A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C40A54
_wcslen.LIBCMT ref: 00C40A8A
_wcslen.LIBCMT ref: 00C40B06
_wcslen.LIBCMT ref: 00C40B81

Part of subcall function 00BCF9F2: _wcslen.LIBCMT ref: 00BCF9FD

Part of subcall function 00C12BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C12BFA

Strings

EXISTS, xrefs: 00C40B7C, 00C40B97
GETITEMCOUNT, xrefs: 00C40C1E
SELECT, xrefs: 00C40D11
EXPAND, xrefs: 00C40BF8
CHECK, xrefs: 00C40A85, 00C40AA0
UNCHECK, xrefs: 00C40D3E
GETTOTALCOUNT, xrefs: 00C409F2, 00C40A17
COLLAPSE, xrefs: 00C40B01, 00C40B1C
ISCHECKED, xrefs: 00C40CE1
GETTEXT, xrefs: 00C40C97
GETSELECTED, xrefs: 00C40C4E

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 29b8257d83880e14f21f8f33c080143d80856ac77b1afd23f6a3c706fc2f9bae
Instruction ID: dbd83d17cfeb989098d38a7c253a380507c21dee3ea507b1b8dc94a7ce19a7aa
Opcode Fuzzy Hash: 29b8257d83880e14f21f8f33c080143d80856ac77b1afd23f6a3c706fc2f9bae
Instruction Fuzzy Hash: C5E1C1356483018FCB14DF25C49196AB7E1FF98314F24899DF9AA9B362DB30EE45CB81

Function 00C3C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C3B6AE,?,?), ref: 00C3C9B5
_wcslen.LIBCMT ref: 00C3C9F1
_wcslen.LIBCMT ref: 00C3CA68
_wcslen.LIBCMT ref: 00C3CA9E
_wcslen.LIBCMT ref: 00C3CAF9
_wcslen.LIBCMT ref: 00C3CB2F
_wcslen.LIBCMT ref: 00C3CB7F

Strings

HKCU, xrefs: 00C3CBCE
HKEY_CLASSES_ROOT, xrefs: 00C3CAF3, 00C3CAF8
HKLM, xrefs: 00C3CA98, 00C3CA9D
HKEY_USERS, xrefs: 00C3CBDF
HKU, xrefs: 00C3CBF0
HKEY_CURRENT_CONFIG, xrefs: 00C3CB79, 00C3CB7E
HKEY_CURRENT_USER, xrefs: 00C3CBBD
HKEY_LOCAL_MACHINE, xrefs: 00C3CA62, 00C3CA67
HKCR, xrefs: 00C3CB29, 00C3CB2E
HKCC, xrefs: 00C3CBAC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 664de6b702f05e2209dc29571b4ccd80b96d3e9c2926b86e678ee494fc10ff68
Instruction ID: 1daafbd718498d7ed87725a6c12ba1a3efcc4823fda2eb7c4f1834930a182886
Opcode Fuzzy Hash: 664de6b702f05e2209dc29571b4ccd80b96d3e9c2926b86e678ee494fc10ff68
Instruction Fuzzy Hash: AC71F23262012A8BCF20DE7DCDD16BE7391AF60754F254268F876B7284EA35CE45D3A0

Function 00C4833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C4835A
_wcslen.LIBCMT ref: 00C4836E
_wcslen.LIBCMT ref: 00C48391
_wcslen.LIBCMT ref: 00C483B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00C483F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00C4361A,?), ref: 00C4844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C48487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00C484CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C48501
FreeLibrary.KERNEL32(?), ref: 00C4850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00C4851D
DestroyIcon.USER32(?), ref: 00C4852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00C48549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00C48555

Strings

.icl, xrefs: 00C48368
.dll, xrefs: 00C483AB
.exe, xrefs: 00C48388

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 4fa58594075bad529c4aea6a40f6e67d0375887318bb0bcd4ad2be881970884f
Instruction ID: b2fb1f500851375796ed3fe4c4bacdeff48af3413e7db07d67b305ed5a426bc2
Opcode Fuzzy Hash: 4fa58594075bad529c4aea6a40f6e67d0375887318bb0bcd4ad2be881970884f
Instruction Fuzzy Hash: 1061E271900215BFEB14DF64CC81BBE77A8FB04711F10465AF925D61E1EBB4AA84DBA0

Function 00BB7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#requireadmin, xrefs: 00BB77FF
#ce, xrefs: 00BB78ED
', xrefs: 00BF5169
Bad directive syntax error, xrefs: 00BF519A
Unterminated group of comments, xrefs: 00BF528C
", xrefs: 00BF5153
#include-once, xrefs: 00BB782F
#include, xrefs: 00BB7847
#comments-end, xrefs: 00BB78D9
#comments-start, xrefs: 00BB785F, 00BB78B1
#pragma compile, xrefs: 00BB77D3
Cannot parse #include, xrefs: 00BF5279
#notrayicon, xrefs: 00BB77E7
#OnAutoItStartRegister, xrefs: 00BB7817
#cs, xrefs: 00BB7873, 00BB78C5

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: f5c36699862ead429081ef44d3f65ca0462ff1f150cc45255300ac610c1f6a24
Instruction ID: 4968c57c43612a06677c9059058bae2d459398eab6c32e341911fe6d1f7ee8fe
Opcode Fuzzy Hash: f5c36699862ead429081ef44d3f65ca0462ff1f150cc45255300ac610c1f6a24
Instruction Fuzzy Hash: F081C271A44609BBDB20AF61CC82FFE77E9EF55300F0440A5FA05AB192EFB0DA15D691

Function 00C23E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00C23EF8
_wcslen.LIBCMT ref: 00C23F03
_wcslen.LIBCMT ref: 00C23F5A
_wcslen.LIBCMT ref: 00C23F98
GetDriveTypeW.KERNEL32(?), ref: 00C23FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C2401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C24059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C24087

Strings

set cd door , xrefs: 00C24028
wait, xrefs: 00C24044
open , xrefs: 00C23FE5
closed, xrefs: 00C23F08, 00C23F2D, 00C23F46, 00C23F7E, 00C23F97
type cdaudio alias cd wait, xrefs: 00C24001
open, xrefs: 00C23F54, 00C23F59
close, xrefs: 00C23EFE, 00C23F18
close cd wait, xrefs: 00C24072

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 244614066955fb76938cd6b4cc84cee81700ca16db1cb7bc249330dea0e04e40
Instruction ID: f6a7b18c7c34144d5f650e5160bddbbce2474a97eb421a4636f5237fda0af612
Opcode Fuzzy Hash: 244614066955fb76938cd6b4cc84cee81700ca16db1cb7bc249330dea0e04e40
Instruction Fuzzy Hash: 247120326043228FC310EF24D8808BAB7F4EF94754F00896DF9A597661EB34EE49CB91

Function 00C15A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00C15A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00C15A40
SetWindowTextW.USER32(?,?), ref: 00C15A57
GetDlgItem.USER32(?,000003EA), ref: 00C15A6C
SetWindowTextW.USER32(00000000,?), ref: 00C15A72
GetDlgItem.USER32(?,000003E9), ref: 00C15A82
SetWindowTextW.USER32(00000000,?), ref: 00C15A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00C15AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00C15AC3
GetWindowRect.USER32(?,?), ref: 00C15ACC
_wcslen.LIBCMT ref: 00C15B33
SetWindowTextW.USER32(?,?), ref: 00C15B6F
GetDesktopWindow.USER32 ref: 00C15B75
GetWindowRect.USER32(00000000), ref: 00C15B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00C15BD3
GetClientRect.USER32(?,?), ref: 00C15BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00C15C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00C15C2F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: f39833fbbf5d38de134c04250c3f854863bc48be9bd51e5759fe04fad6cd4478
Instruction ID: f514d1e8e68f93e4f4fe627fa11589620df965c6b725ecf7d2eccf7b648ff167
Opcode Fuzzy Hash: f39833fbbf5d38de134c04250c3f854863bc48be9bd51e5759fe04fad6cd4478
Instruction Fuzzy Hash: 6A719D31900B09EFDB20DFA9CE85BAEBBF5FF89704F104518E552A25A0D775EA80DB50

Function 00C2FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00C2FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00C2FE32
LoadCursorW.USER32(00000000,00007F00), ref: 00C2FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00C2FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00C2FE53
LoadCursorW.USER32(00000000,00007F01), ref: 00C2FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00C2FE69
LoadCursorW.USER32(00000000,00007F88), ref: 00C2FE74
LoadCursorW.USER32(00000000,00007F80), ref: 00C2FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00C2FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00C2FE95
LoadCursorW.USER32(00000000,00007F85), ref: 00C2FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00C2FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00C2FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00C2FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00C2FECC
GetCursorInfo.USER32(?), ref: 00C2FEDC
GetLastError.KERNEL32 ref: 00C2FF1E

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: a0cb2fc3a320103768aa3d7f24e17e62572fb168e19b91f4423bf8ea58753d66
Instruction ID: e54f0d9bab3df45fd63de5176c9726f7feb23d0c0f432ac8520a6c88ec67d7c5
Opcode Fuzzy Hash: a0cb2fc3a320103768aa3d7f24e17e62572fb168e19b91f4423bf8ea58753d66
Instruction Fuzzy Hash: B64160B0D043196ADB10DFBA9C8996EBFF8BF04354B50457AF11DE7291DB78A901CE90

Function 00BD00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00BD00C6

Part of subcall function 00BD00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00C8070C,00000FA0,90F9FBA4,?,?,?,?,00BF23B3,000000FF), ref: 00BD011C
Part of subcall function 00BD00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00BF23B3,000000FF), ref: 00BD0127
Part of subcall function 00BD00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00BF23B3,000000FF), ref: 00BD0138
Part of subcall function 00BD00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00BD014E
Part of subcall function 00BD00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00BD015C
Part of subcall function 00BD00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00BD016A
Part of subcall function 00BD00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BD0195
Part of subcall function 00BD00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BD01A0

___scrt_fastfail.LIBCMT ref: 00BD00E7

Part of subcall function 00BD00A3: __onexit.LIBCMT ref: 00BD00A9

Strings

InitializeConditionVariable, xrefs: 00BD0148
WakeAllConditionVariable, xrefs: 00BD0162
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00BD0122
kernel32.dll, xrefs: 00BD0133
SleepConditionVariableCS, xrefs: 00BD0154

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: c37dae9600c454d535e07c1b3b7627b22320c7bb8d523a87e4f745feed45fef2
Instruction ID: 537698f39c91d9acee3bae37109d27fd7f0c1ab6f473d2a0f38f8aa36ee294c5
Opcode Fuzzy Hash: c37dae9600c454d535e07c1b3b7627b22320c7bb8d523a87e4f745feed45fef2
Instruction Fuzzy Hash: D421C636A557116BE7517FA4AC45B6EB7D4FF05B61F1001BEF801A33A1EF7498008A94

Function 00C130F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C1318D
_wcslen.LIBCMT ref: 00C131F8

Strings

TEXT, xrefs: 00C1347C
INSTANCE, xrefs: 00C13453
CLASS, xrefs: 00C13188, 00C131A5
REGEXPCLASS, xrefs: 00C13255, 00C13266
NAME, xrefs: 00C13335, 00C13346
CLASSNN, xrefs: 00C131F3, 00C13204

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 06601d1bac018c8e7fdadd0fda69c58c07d523b92f84a21a476c362b9a8fd513
Instruction ID: 2c6f434de6dc02e02652f68bc444a964bd800f53c4cb0fbe0cb9440ef73dc2ee
Opcode Fuzzy Hash: 06601d1bac018c8e7fdadd0fda69c58c07d523b92f84a21a476c362b9a8fd513
Instruction Fuzzy Hash: 63E13531A00556ABCF149FA8C8416FDFBB5BF05714F64816AE466F3240DB70AFC5A790

Function 00C244C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00C4CC08), ref: 00C24527
_wcslen.LIBCMT ref: 00C2453B
_wcslen.LIBCMT ref: 00C24599
_wcslen.LIBCMT ref: 00C245F4
_wcslen.LIBCMT ref: 00C2463F
_wcslen.LIBCMT ref: 00C246A7

Part of subcall function 00BCF9F2: _wcslen.LIBCMT ref: 00BCF9FD

GetDriveTypeW.KERNEL32(?,00C76BF0,00000061), ref: 00C24743

Strings

network, xrefs: 00C2469D, 00C246A2
all, xrefs: 00C24531, 00C24536
unknown, xrefs: 00C24708
fixed, xrefs: 00C24635, 00C2463A
removable, xrefs: 00C245EA, 00C245EF
ramdisk, xrefs: 00C246F1
cdrom, xrefs: 00C2458F, 00C24594

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 37d07b96f97b4c94e0f4c738fdb28749fbc648fdac216e88b4f34bbb8773bb3a
Instruction ID: 5fad1606df2d2f4fd35789fb4a76976bcab87b9ac41ed3d0b2bf18e20cbea796
Opcode Fuzzy Hash: 37d07b96f97b4c94e0f4c738fdb28749fbc648fdac216e88b4f34bbb8773bb3a
Instruction Fuzzy Hash: 0CB123316083229FC718DF28E890A7EB7E5BFA5720F50492DF4A6C7691EB70D944CB52

Function 00C33FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C4CC08), ref: 00C340BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00C340CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00C4CC08), ref: 00C340F2
FreeLibrary.KERNEL32(00000000,?,00C4CC08), ref: 00C3413E
StringFromGUID2.OLE32(?,?,00000028,?,00C4CC08), ref: 00C341A8
SysFreeString.OLEAUT32(00000009), ref: 00C34262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00C342C8
SysFreeString.OLEAUT32(?), ref: 00C342F2

Strings

GetModuleHandleExW, xrefs: 00C340C7
kernel32.dll, xrefs: 00C340B6

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: e23f68437602c889252e12e273d726e00f56abf2a3ff2df38d1066d716a28402
Instruction ID: 2dc76d46afefba4b94b27c08814ee5d021ff1451a524ab7790a8f123cd1591a3
Opcode Fuzzy Hash: e23f68437602c889252e12e273d726e00f56abf2a3ff2df38d1066d716a28402
Instruction Fuzzy Hash: 07123B75A10115EFDB18CF94C884EAEBBB5FF45314F248098E915AB261D731EE46CBA0

Function 00BB326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00C81990), ref: 00BF2F8D
GetMenuItemCount.USER32(00C81990), ref: 00BF303D
GetCursorPos.USER32(?), ref: 00BF3081
SetForegroundWindow.USER32(00000000), ref: 00BF308A
TrackPopupMenuEx.USER32(00C81990,00000000,?,00000000,00000000,00000000), ref: 00BF309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00BF30A9

Strings

0, xrefs: 00BB327D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 3121164803a08efbb358dcbf085c147009e17a063b11dd356f7d2f804296fe76
Instruction ID: a84dda197679b25a2ef276120827421d20fac5da6ffe87faccd5e98050f025a1
Opcode Fuzzy Hash: 3121164803a08efbb358dcbf085c147009e17a063b11dd356f7d2f804296fe76
Instruction Fuzzy Hash: 0C71E170640209BBEB218B64CC89FFEBFE4FB05724F204256F614AA1E0C7B1AD54DB90

Function 00C46CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00C46DEB

Part of subcall function 00BB6B57: _wcslen.LIBCMT ref: 00BB6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00C46E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00C46E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C46E94
DestroyWindow.USER32(?), ref: 00C46EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00BB0000,00000000), ref: 00C46EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C46EFD
GetDesktopWindow.USER32 ref: 00C46F16
GetWindowRect.USER32(00000000), ref: 00C46F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C46F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00C46F4D

Part of subcall function 00BC9944: GetWindowLongW.USER32(?,000000EB), ref: 00BC9952

Strings

0, xrefs: 00C46D98
tooltips_class32, xrefs: 00C46E58, 00C46EDD

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: c0306186b51d34707028d90adae6412fa3df236b142ee8c884b517fa356771e8
Instruction ID: dd6d50d53e0c3d8c91bd3bd89fe103e40865578465b3d8ac27a1ed306abbd2c3
Opcode Fuzzy Hash: c0306186b51d34707028d90adae6412fa3df236b142ee8c884b517fa356771e8
Instruction Fuzzy Hash: 3B715B74104344AFEB21CF58DC84FAABBF9FB8A314F04451DF99987261C771A90ACB16

Function 00C4911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BC9BB2

DragQueryPoint.SHELL32(?,?), ref: 00C49147

Part of subcall function 00C47674: ClientToScreen.USER32(?,?), ref: 00C4769A
Part of subcall function 00C47674: GetWindowRect.USER32(?,?), ref: 00C47710
Part of subcall function 00C47674: PtInRect.USER32(?,?,00C48B89), ref: 00C47720

SendMessageW.USER32(?,000000B0,?,?), ref: 00C491B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00C491BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00C491DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00C49225
SendMessageW.USER32(?,000000B0,?,?), ref: 00C4923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00C49255
SendMessageW.USER32(?,000000B1,?,?), ref: 00C49277
DragFinish.SHELL32(?), ref: 00C4927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00C49371

Strings

@GUI_DROPID, xrefs: 00C4929E
@GUI_DRAGFILE, xrefs: 00C49320
@GUI_DRAGID, xrefs: 00C492E9

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: ccf0c0f44623533c08ae2165406ad1042e678de80beb3296ad45f90c7886504a
Instruction ID: ac7f8c4f97dc20ae7de45240d4ea8d49ef32845bcdf9d18dec8f626a40fa6c47
Opcode Fuzzy Hash: ccf0c0f44623533c08ae2165406ad1042e678de80beb3296ad45f90c7886504a
Instruction Fuzzy Hash: 0D615871108301AFD701EF64DC85EAFBBE8FF89750F000A6EF995921A1DB709A49CB52

Function 00C2C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C2C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00C2C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00C2C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00C2C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00C2C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00C2C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C2C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C2C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00C2C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00C2C5F0
InternetCloseHandle.WININET(00000000), ref: 00C2C5FB

Strings

, xrefs: 00C2C575

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: d886bd482593adf8040eaed44513c6e59ec194c2f3984ab5c88e426a8fa81a6e
Instruction ID: 064210657d8f1c3797aebaebe71fd11069c6f6822bbde7eb354e2da459d3a094
Opcode Fuzzy Hash: d886bd482593adf8040eaed44513c6e59ec194c2f3984ab5c88e426a8fa81a6e
Instruction Fuzzy Hash: B4515AB4501618BFDB219F61D9C8BAF7BFCFF09344F004429F95696A20DB74EA04AB60

Function 00C4856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00C48592
GetFileSize.KERNEL32(00000000,00000000), ref: 00C485A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00C485AD
CloseHandle.KERNEL32(00000000), ref: 00C485BA
GlobalLock.KERNEL32(00000000), ref: 00C485C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00C485D7
GlobalUnlock.KERNEL32(00000000), ref: 00C485E0
CloseHandle.KERNEL32(00000000), ref: 00C485E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00C485F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00C4FC38,?), ref: 00C48611
GlobalFree.KERNEL32(00000000), ref: 00C48621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00C48641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00C48671
DeleteObject.GDI32(00000000), ref: 00C48699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00C486AF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 99e18a0a59bdd1485646632346f61405a9b158613a3447d66137b1d5d12f7a8a
Instruction ID: b44e9c6a7f9ae7744e81b3133143e884e682a71bff3c4511d3581d7a60bad188
Opcode Fuzzy Hash: 99e18a0a59bdd1485646632346f61405a9b158613a3447d66137b1d5d12f7a8a
Instruction Fuzzy Hash: FC413C75601204AFDB619FA5CC88FAE7BB8FF8A711F104059F915E7260DB709E05DB20

Function 00C214BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00C21502
VariantCopy.OLEAUT32(?,?), ref: 00C2150B
VariantClear.OLEAUT32(?), ref: 00C21517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00C215FB
VarR8FromDec.OLEAUT32(?,?), ref: 00C21657
VariantInit.OLEAUT32(?), ref: 00C21708
SysFreeString.OLEAUT32(?), ref: 00C2178C
VariantClear.OLEAUT32(?), ref: 00C217D8
VariantClear.OLEAUT32(?), ref: 00C217E7
VariantInit.OLEAUT32(00000000), ref: 00C21823

Strings

Default, xrefs: 00C216AF
%4d%02d%02d%02d%02d%02d, xrefs: 00C21625

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 7c8e0a90565df57decad0edf25eac1f7606df3ea5178c33e908f26e5532b429f
Instruction ID: 3b23d460225e4239a8cca1fa1a2193f34053e033c50a23921acb617b1edea68b
Opcode Fuzzy Hash: 7c8e0a90565df57decad0edf25eac1f7606df3ea5178c33e908f26e5532b429f
Instruction Fuzzy Hash: 77D1F331A00229DBDB109F66E885BBDB7F5BF55700F1880EAF806AB990DB70DD41DB61

Function 00C3B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00C3C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C3B6AE,?,?), ref: 00C3C9B5
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3C9F1
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3CA68
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C3B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C3B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00C3B80A
RegCloseKey.ADVAPI32(?), ref: 00C3B87E
RegCloseKey.ADVAPI32(?), ref: 00C3B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00C3B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C3B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00C3B922
FreeLibrary.KERNEL32(00000000), ref: 00C3B983
RegCloseKey.ADVAPI32(00000000), ref: 00C3B994

Strings

RegDeleteKeyExW, xrefs: 00C3B8FE
advapi32.dll, xrefs: 00C3B8ED

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 027af3bd854f369fc5d642870f8548ec8c34fed236fd3a0f35f070a31d1177cb
Instruction ID: d3233c9a9fb7ffeb5b5b8cfc6e23b3b589735a62fad5fde400e189e2294359fa
Opcode Fuzzy Hash: 027af3bd854f369fc5d642870f8548ec8c34fed236fd3a0f35f070a31d1177cb
Instruction Fuzzy Hash: 4CC18B34218201AFD714DF14C495F6ABBE5FF85308F14859CF6AA8B2A2CB71ED45CB92

Function 00C3255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C325D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00C325E8
CreateCompatibleDC.GDI32(?), ref: 00C325F4
SelectObject.GDI32(00000000,?), ref: 00C32601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00C3266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00C326AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00C326D0
SelectObject.GDI32(?,?), ref: 00C326D8
DeleteObject.GDI32(?), ref: 00C326E1
DeleteDC.GDI32(?), ref: 00C326E8
ReleaseDC.USER32(00000000,?), ref: 00C326F3

Strings

(, xrefs: 00C3268D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 1e1cc2234d2319fff71762ba281484f6dc06f7560f11b5976734a5b36bfb6827
Instruction ID: ef3c87b2d232407bb8ef4762968551e74303a5bab0230c295b667ef6bc9962ae
Opcode Fuzzy Hash: 1e1cc2234d2319fff71762ba281484f6dc06f7560f11b5976734a5b36bfb6827
Instruction Fuzzy Hash: 8761E275D01219EFCF14CFA4D885AAEBBF6FF48310F208529E956A7260D770A941DF90

Function 00BEDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00BEDAA1

Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED659
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED66B
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED67D
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED68F
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED6A1
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED6B3
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED6C5
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED6D7
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED6E9
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED6FB
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED70D
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED71F
Part of subcall function 00BED63C: _free.LIBCMT ref: 00BED731

_free.LIBCMT ref: 00BEDA96

Part of subcall function 00BE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000), ref: 00BE29DE
Part of subcall function 00BE29C8: GetLastError.KERNEL32(00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000,00000000), ref: 00BE29F0

_free.LIBCMT ref: 00BEDAB8
_free.LIBCMT ref: 00BEDACD
_free.LIBCMT ref: 00BEDAD8
_free.LIBCMT ref: 00BEDAFA
_free.LIBCMT ref: 00BEDB0D
_free.LIBCMT ref: 00BEDB1B
_free.LIBCMT ref: 00BEDB26
_free.LIBCMT ref: 00BEDB5E
_free.LIBCMT ref: 00BEDB65
_free.LIBCMT ref: 00BEDB82
_free.LIBCMT ref: 00BEDB9A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 5b3aa79cc4b3863f9b067431ee4bbdf89fe4459d0c9bf07f25abe7bea9ed0e25
Instruction ID: 84f3fdd4c70db89c60fdef8103cd04cf74462d17195a338fad42ddc864a4b027
Opcode Fuzzy Hash: 5b3aa79cc4b3863f9b067431ee4bbdf89fe4459d0c9bf07f25abe7bea9ed0e25
Instruction Fuzzy Hash: 16318F356043899FEB21AB3AE846B5A77E8FF00310F1154B9E458D7292EFB9ED40C720

Function 00C1365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00C1369C
_wcslen.LIBCMT ref: 00C136A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00C13797
GetClassNameW.USER32(?,?,00000400), ref: 00C1380C
GetDlgCtrlID.USER32(?), ref: 00C1385D
GetWindowRect.USER32(?,?), ref: 00C13882
GetParent.USER32(?), ref: 00C138A0
ScreenToClient.USER32(00000000), ref: 00C138A7
GetClassNameW.USER32(?,?,00000100), ref: 00C13921
GetWindowTextW.USER32(?,?,00000400), ref: 00C1395D

Strings

%s%u, xrefs: 00C13734

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 47410e8ae1a9ec4724ba09ea5792363b5e4e0157ce544dd13b389215763b0e17
Instruction ID: bd2e2f847552133ec9aea22b68771fcbd467c82897cb612996d7b4564ede8c76
Opcode Fuzzy Hash: 47410e8ae1a9ec4724ba09ea5792363b5e4e0157ce544dd13b389215763b0e17
Instruction Fuzzy Hash: 6A91D371200646AFD719DF24C885FEAF7E8FF46354F008529F9A9D2190DB30EA85DBA1

Function 00C14954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00C14994
GetWindowTextW.USER32(?,?,00000400), ref: 00C149DA
_wcslen.LIBCMT ref: 00C149EB
CharUpperBuffW.USER32(?,00000000), ref: 00C149F7
_wcsstr.LIBVCRUNTIME ref: 00C14A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00C14A64
GetWindowTextW.USER32(?,?,00000400), ref: 00C14A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00C14AE6
GetClassNameW.USER32(?,?,00000400), ref: 00C14B20
GetWindowRect.USER32(?,?), ref: 00C14B8B

Strings

ThumbnailClass, xrefs: 00C14A6F, 00C14AF1

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 443e44f79971582bf0fdc639bf6a66b58db6027f5dfaf77c7f8753cb7f1d87c0
Instruction ID: 4a41db6259be2d5fb378253914572ea1a5229ca71dc747c471314b71dab02e95
Opcode Fuzzy Hash: 443e44f79971582bf0fdc639bf6a66b58db6027f5dfaf77c7f8753cb7f1d87c0
Instruction Fuzzy Hash: 6791C3710082059FDB08CF14C985FEAB7E8FF46354F04846AFD959A195EB30EE85EBA1

Function 00C1BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00C81990,000000FF,00000000,00000030), ref: 00C1BFAC
SetMenuItemInfoW.USER32(00C81990,00000004,00000000,00000030), ref: 00C1BFE1
Sleep.KERNEL32(000001F4), ref: 00C1BFF3
GetMenuItemCount.USER32(?), ref: 00C1C039
GetMenuItemID.USER32(?,00000000), ref: 00C1C056
GetMenuItemID.USER32(?,-00000001), ref: 00C1C082
GetMenuItemID.USER32(?,?), ref: 00C1C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C1C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C1C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C1C145

Strings

0, xrefs: 00C1BF3D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 46b71dbfdfa4460ffe80e6ff40c79fcf0d99aaa352e328bd0cb37637e459f995
Instruction ID: 172c0cf2300ff32804c438ecc9d6c234fa463b534463e1b10c502d55e25ba37c
Opcode Fuzzy Hash: 46b71dbfdfa4460ffe80e6ff40c79fcf0d99aaa352e328bd0cb37637e459f995
Instruction Fuzzy Hash: 6A616CB498024AEFDB11CF64CDC8BEE7BA8FB06354F144155F811A3291C735AE95EB60

Function 00C3CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00C3CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00C3CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00C3CD48

Part of subcall function 00C3CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00C3CCAA
Part of subcall function 00C3CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00C3CCBD
Part of subcall function 00C3CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C3CCCF
Part of subcall function 00C3CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00C3CD05
Part of subcall function 00C3CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00C3CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00C3CCF3

Strings

RegDeleteKeyExW, xrefs: 00C3CCC9
advapi32.dll, xrefs: 00C3CCB8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 2b3434581ac4319cfbab86fc80a9abdfaacd31d2034265732c08a3f5c75c0a8c
Instruction ID: 1b54d5a933d4a51bb43ebd4b6e14985672d9c3c943a49dad19f783008d363321
Opcode Fuzzy Hash: 2b3434581ac4319cfbab86fc80a9abdfaacd31d2034265732c08a3f5c75c0a8c
Instruction Fuzzy Hash: 87315A75902129BBDB208B65DCC8FFFBB7CEF46750F000165F916E2250DA349A45DBA0

Function 00C23D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00C23D40
_wcslen.LIBCMT ref: 00C23D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C23D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00C23DBE
RemoveDirectoryW.KERNEL32(?), ref: 00C23DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00C23E55
CloseHandle.KERNEL32(00000000), ref: 00C23E60
CloseHandle.KERNEL32(00000000), ref: 00C23E6B

Strings

:, xrefs: 00C23D82
\, xrefs: 00C23D77
\??\%s, xrefs: 00C23D5B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 8a43e9e5d090cf62f80d8357ae83c851a46a4b836def2b38c0d8c3190cab32b8
Instruction ID: 114b06c1602cbf3a06ed4953f59718ff79427e7db90277286aa5d9f6c2b9fbd1
Opcode Fuzzy Hash: 8a43e9e5d090cf62f80d8357ae83c851a46a4b836def2b38c0d8c3190cab32b8
Instruction Fuzzy Hash: 6E31C176A10259ABDB219FA0DC88FEF37BCEF89700F1040B6F519D2160E77497448B24

Function 00C1E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00C1E6B4

Part of subcall function 00BCE551: timeGetTime.WINMM(?,?,00C1E6D4), ref: 00BCE555

Sleep.KERNEL32(0000000A), ref: 00C1E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00C1E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00C1E727
SetActiveWindow.USER32 ref: 00C1E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00C1E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00C1E773
Sleep.KERNEL32(000000FA), ref: 00C1E77E
IsWindow.USER32 ref: 00C1E78A
EndDialog.USER32(00000000), ref: 00C1E79B

Strings

BUTTON, xrefs: 00C1E719

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 89a836b2a4dfff032caf195c27734820117a624e2e59271bece18ed26df36d8b
Instruction ID: 929b84309d763141e6d86703c286d408038c831437228a423c4abea16220ed84
Opcode Fuzzy Hash: 89a836b2a4dfff032caf195c27734820117a624e2e59271bece18ed26df36d8b
Instruction Fuzzy Hash: 9E216F74201644AFFB005F60ECCDBAD3BA9FB57748B144424FD15C22B1EB71AC40AB68

Function 00C1E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00C1EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00C1EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C1EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00C1EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00C1EAA7

Strings

open , xrefs: 00C1EA0C
alias PlayMe, xrefs: 00C1EA36
status PlayMe mode, xrefs: 00C1EA58
play PlayMe wait, xrefs: 00C1EA91
play PlayMe, xrefs: 00C1EAA2
close PlayMe, xrefs: 00C1EA6E, 00C1EA9B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: cb7bcb0294aecc269023ce8aa9876545a3db67dcb06f24cc73bd03a4d7559a2c
Instruction ID: ad832bded8240efc0f3077b1d7b837e13e536c77de0e1f4aa80c527a9d9a1f11
Opcode Fuzzy Hash: cb7bcb0294aecc269023ce8aa9876545a3db67dcb06f24cc73bd03a4d7559a2c
Instruction Fuzzy Hash: 8F115131A502697AD720A7A2DC4AEFF6EBCEFD2F40F444479B915A20D1EAB00A45D5B0

Function 00C19F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C1A012
SetKeyboardState.USER32(?), ref: 00C1A07D
GetAsyncKeyState.USER32(000000A0), ref: 00C1A09D
GetKeyState.USER32(000000A0), ref: 00C1A0B4
GetAsyncKeyState.USER32(000000A1), ref: 00C1A0E3
GetKeyState.USER32(000000A1), ref: 00C1A0F4
GetAsyncKeyState.USER32(00000011), ref: 00C1A120
GetKeyState.USER32(00000011), ref: 00C1A12E
GetAsyncKeyState.USER32(00000012), ref: 00C1A157
GetKeyState.USER32(00000012), ref: 00C1A165
GetAsyncKeyState.USER32(0000005B), ref: 00C1A18E
GetKeyState.USER32(0000005B), ref: 00C1A19C

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: e9a3d244c20d26b50b4216279f6f519f2c4fa35e3390a20bafe158c349c2448c
Instruction ID: 7eeb5c512dd8cd61ab527a9dd37ca825d25972416f54c62f54440a130afc1a43
Opcode Fuzzy Hash: e9a3d244c20d26b50b4216279f6f519f2c4fa35e3390a20bafe158c349c2448c
Instruction Fuzzy Hash: 9951D9709057847AFB35EBB088107EEAFB49F13380F088599D5D2571C2DA649BCCE762

Function 00C15CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00C15CE2
GetWindowRect.USER32(00000000,?), ref: 00C15CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00C15D59
GetDlgItem.USER32(?,00000002), ref: 00C15D69
GetWindowRect.USER32(00000000,?), ref: 00C15D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00C15DCF
GetDlgItem.USER32(?,000003E9), ref: 00C15DDD
GetWindowRect.USER32(00000000,?), ref: 00C15DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00C15E31
GetDlgItem.USER32(?,000003EA), ref: 00C15E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00C15E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00C15E67

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 45298a47033f859f922162e234e6f842fc663b5ce2d13eeca29a6aaba5a3c62f
Instruction ID: 4dfccbbd85cb5bf2552c20b8510d26f3d8ce67fbf082a2e7374aae23a62f07b3
Opcode Fuzzy Hash: 45298a47033f859f922162e234e6f842fc663b5ce2d13eeca29a6aaba5a3c62f
Instruction Fuzzy Hash: 7D511CB4A00605AFDB18DF69DD89BEEBBB5BF89300F108129F915E6290D7709E40CB50

Function 00BC8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BC8BE8,?,00000000,?,?,?,?,00BC8BBA,00000000,?), ref: 00BC8FC5

DestroyWindow.USER32(?), ref: 00BC8C81
KillTimer.USER32(00000000,?,?,?,?,00BC8BBA,00000000,?), ref: 00BC8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00C06973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00BC8BBA,00000000,?), ref: 00C069A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00BC8BBA,00000000,?), ref: 00C069B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00BC8BBA,00000000), ref: 00C069D4
DeleteObject.GDI32(00000000), ref: 00C069E6

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 795fe7685e725f724fdb2bd93b36da0ceb85164173f2e4615be8dd65be844d94
Instruction ID: 51a474fcdea959445aa6f2a4379dc4d2e25588899b43bbe68e339876c94b1f01
Opcode Fuzzy Hash: 795fe7685e725f724fdb2bd93b36da0ceb85164173f2e4615be8dd65be844d94
Instruction Fuzzy Hash: 8661AC31502700DFDB259F14D988B2AB7F1FB41322F1845ACE4529B9B0CB35AE91DFA8

Function 00BC9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00BC9944: GetWindowLongW.USER32(?,000000EB), ref: 00BC9952

GetSysColor.USER32(0000000F), ref: 00BC9862

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 55e89296936359740e475b3340eed4db80df5ae86ee40c1a3b80e6098e898230
Instruction ID: fbcfc8a0e5be14383c33541981ba6a9e22e41c61487a8840d02202405e1c1289
Opcode Fuzzy Hash: 55e89296936359740e475b3340eed4db80df5ae86ee40c1a3b80e6098e898230
Instruction Fuzzy Hash: AE417B35505640AFEB205B389C88FBD3BA5FB06371F144699F9B28B1E2D7719D42DB20

Function 00C196E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00BFF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00C19717
LoadStringW.USER32(00000000,?,00BFF7F8,00000001), ref: 00C19720

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00BFF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00C19742
LoadStringW.USER32(00000000,?,00BFF7F8,00000001), ref: 00C19745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00C19866

Strings

^ ERROR, xrefs: 00C197FB
%s (%d) : ==> %s: %s %s, xrefs: 00C1984A
Line %d:, xrefs: 00C197A0
Line %d (File "%s"):, xrefs: 00C1978F
Error: , xrefs: 00C1981D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 7db6a97bba817ff4b809b9f72e97c9f0c779706b25e079754cd7f645eee6e82d
Instruction ID: 903fe52864735918deda2ac82ca85c8343c8c860b9d12b276e6405210d8d6224
Opcode Fuzzy Hash: 7db6a97bba817ff4b809b9f72e97c9f0c779706b25e079754cd7f645eee6e82d
Instruction Fuzzy Hash: E2414072800209ABDB14EBE0CD96EFE77B8EF15740F5400A5F60572092EBB56F48DB61

Function 00C106DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB6B57: _wcslen.LIBCMT ref: 00BB6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00C107A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00C107BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00C107DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00C10804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00C1082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C10837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C1083C

Strings

\IPC$, xrefs: 00C10784
SOFTWARE\Classes\, xrefs: 00C1070E
\CLSID, xrefs: 00C10724

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 83dff4cfeeab4ff28bb5e17579b08924377d71bf2aa9fb1656410961ac38999d
Instruction ID: e6a10b0557ba9970c3767c1dc6f48f468205ff865932bf4bd266dcf0cb656d69
Opcode Fuzzy Hash: 83dff4cfeeab4ff28bb5e17579b08924377d71bf2aa9fb1656410961ac38999d
Instruction Fuzzy Hash: 6F413872C10229ABDF11EBA4DC85DFEB7B8BF04750B144169E911A31A0EBB09E84CB90

Function 00C43F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00C4403B
CreateCompatibleDC.GDI32(00000000), ref: 00C44042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00C44055
SelectObject.GDI32(00000000,00000000), ref: 00C4405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00C44068
DeleteDC.GDI32(00000000), ref: 00C44072
GetWindowLongW.USER32(?,000000EC), ref: 00C4407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00C44092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00C4409E

Strings

static, xrefs: 00C43FD3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: d6cd8cd0b25c1debcb4a10d456ec0acae3d754bad6a59db0523395ebc598d0a0
Instruction ID: e3edace1935d1948d7099e571b72271ff08980e8355219e81b57257e77ce5e59
Opcode Fuzzy Hash: d6cd8cd0b25c1debcb4a10d456ec0acae3d754bad6a59db0523395ebc598d0a0
Instruction Fuzzy Hash: F2315A36502219ABDF219FA4DC49FDE3BA8FF0E324F110211FA29A61A0C775D920DB54

Function 00C33C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C33C5C
CoInitialize.OLE32(00000000), ref: 00C33C8A
CoUninitialize.OLE32 ref: 00C33C94
_wcslen.LIBCMT ref: 00C33D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00C33DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00C33ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00C33F0E
CoGetObject.OLE32(?,00000000,00C4FB98,?), ref: 00C33F2D
SetErrorMode.KERNEL32(00000000), ref: 00C33F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00C33FC4
VariantClear.OLEAUT32(?), ref: 00C33FD8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 6a2cdbad1f0e5ac7a90296c46edf7973d23fa1ccdaabf6c53d870a843cf9ec6a
Instruction ID: b9f465cdd9b79714d7ac7e15eb07742636868ba687291e3d2e3bc083f05a90dc
Opcode Fuzzy Hash: 6a2cdbad1f0e5ac7a90296c46edf7973d23fa1ccdaabf6c53d870a843cf9ec6a
Instruction Fuzzy Hash: BEC166716183419FC700DF68C884A2BBBE9FF89744F10495DF98A9B260DB71EE45CB52

Function 00C27A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C27AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00C27B8F
SHGetDesktopFolder.SHELL32(?), ref: 00C27BA3
CoCreateInstance.OLE32(00C4FD08,00000000,00000001,00C76E6C,?), ref: 00C27BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00C27C74
CoTaskMemFree.OLE32(?,?), ref: 00C27CCC
SHBrowseForFolderW.SHELL32(?), ref: 00C27D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00C27D7A
CoTaskMemFree.OLE32(00000000), ref: 00C27D81
CoTaskMemFree.OLE32(00000000), ref: 00C27DD6
CoUninitialize.OLE32 ref: 00C27DDC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 54f79791eaea05381e374567f97aef3df85d3a6851bd1db3cb3c734135d1515d
Instruction ID: c92e3feec489f1e5f222c3962b2b8988d009fc9325af74d4683a1dea8a6294d7
Opcode Fuzzy Hash: 54f79791eaea05381e374567f97aef3df85d3a6851bd1db3cb3c734135d1515d
Instruction Fuzzy Hash: BEC13C75A04119AFCB14DF64D8C8DAEBBF9FF48304B148599E8169B661DB30EE41CB90

Function 00C4541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00C45504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C45515
CharNextW.USER32(00000158), ref: 00C45544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00C45585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00C4559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C455AC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 26dbb3823f4e52620081c970327d05ed6ab9755d582723164529835fe5c5bb75
Instruction ID: 8f6a797200f4927a72f2719759dfac953877710b5bca44430d3e0c1c99efd8ea
Opcode Fuzzy Hash: 26dbb3823f4e52620081c970327d05ed6ab9755d582723164529835fe5c5bb75
Instruction Fuzzy Hash: 70619074905608EFDF109F65CC84AFE7BB9FF06720F108145F925AB2A2D7748A81DB60

Function 00C0FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00C0FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00C0FB08
VariantInit.OLEAUT32(?), ref: 00C0FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00C0FB3A
VariantCopy.OLEAUT32(?,?), ref: 00C0FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00C0FBA1
VariantClear.OLEAUT32(?), ref: 00C0FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00C0FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C0FBCC
VariantClear.OLEAUT32(?), ref: 00C0FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C0FBE9

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 5c9b7210ef8144e9c722221f8ac8547f8b6d85e31d740678e9b3fa33e828a61d
Instruction ID: e3585c15335c6a1910f1d1c2e5462f81c989ffde8426d1243ea1027f0e1206f0
Opcode Fuzzy Hash: 5c9b7210ef8144e9c722221f8ac8547f8b6d85e31d740678e9b3fa33e828a61d
Instruction Fuzzy Hash: 49415235A00219DFCB10DF64C894ABDBBB9FF48354F008069E955A7261C734E986CFA0

Function 00C19C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C19CA1
GetAsyncKeyState.USER32(000000A0), ref: 00C19D22
GetKeyState.USER32(000000A0), ref: 00C19D3D
GetAsyncKeyState.USER32(000000A1), ref: 00C19D57
GetKeyState.USER32(000000A1), ref: 00C19D6C
GetAsyncKeyState.USER32(00000011), ref: 00C19D84
GetKeyState.USER32(00000011), ref: 00C19D96
GetAsyncKeyState.USER32(00000012), ref: 00C19DAE
GetKeyState.USER32(00000012), ref: 00C19DC0
GetAsyncKeyState.USER32(0000005B), ref: 00C19DD8
GetKeyState.USER32(0000005B), ref: 00C19DEA

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 91f8f289900ded9035eea4758fe2153fa3c50375c8e0c93c3b19e795b1d8e371
Instruction ID: 2fa4efbf0620ffda9437e1a7cba06470de9e1441a3cbcc9014a9a4f3a829c978
Opcode Fuzzy Hash: 91f8f289900ded9035eea4758fe2153fa3c50375c8e0c93c3b19e795b1d8e371
Instruction Fuzzy Hash: 0A41E5346047C969FF309664D8643E5BEB0EF13304F08805ADAD6566C2DBB49BC8E7A2

Function 00C3055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00C305BC
inet_addr.WSOCK32(?), ref: 00C3061C
gethostbyname.WSOCK32(?), ref: 00C30628
IcmpCreateFile.IPHLPAPI ref: 00C30636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00C306C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00C306E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00C307B9
WSACleanup.WSOCK32 ref: 00C307BF

Strings

Ping, xrefs: 00C30676

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 81098836a6ad099394d6e3f53c7a1112b3d04bc212dffd8ef89b4c0889ec69fa
Instruction ID: c80dba68784eac38fb2751c648596315961bd0aae096480194a72fa1e0e2ac5f
Opcode Fuzzy Hash: 81098836a6ad099394d6e3f53c7a1112b3d04bc212dffd8ef89b4c0889ec69fa
Instruction Fuzzy Hash: D0918D366182019FD320DF15C899F2ABBE0BF45318F2485A9F46A9B6A2C770ED45CF91

Function 00C38CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00C38CF3

Part of subcall function 00C18E54: _wcslen.LIBCMT ref: 00C18E77

_wcslen.LIBCMT ref: 00C38D4E
_wcslen.LIBCMT ref: 00C38D9C
_wcslen.LIBCMT ref: 00C38DDC
_wcslen.LIBCMT ref: 00C38E6E

Strings

cdecl, xrefs: 00C38D48, 00C38D4D
winapi, xrefs: 00C38D96, 00C38D9B
none, xrefs: 00C38E65, 00C38E6A
stdcall, xrefs: 00C38DD6, 00C38DDB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 15bbc1a9e395f06fb776ee50cb18d51ced67490d6157b8a968c2860117916af7
Instruction ID: b48f0b72abca81498e4e0cee6bce29e03078afe0b7de100bcf3450108a5af8b4
Opcode Fuzzy Hash: 15bbc1a9e395f06fb776ee50cb18d51ced67490d6157b8a968c2860117916af7
Instruction Fuzzy Hash: 5651AF35A106169BCF14DF68C9909BEB7E5BF65720F204229F826E72C4EB34DE48C790

Function 00C3372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00C33774
CoUninitialize.OLE32 ref: 00C3377F
CoCreateInstance.OLE32(?,00000000,00000017,00C4FB78,?), ref: 00C337D9
IIDFromString.OLE32(?,?), ref: 00C3384C
VariantInit.OLEAUT32(?), ref: 00C338E4
VariantClear.OLEAUT32(?), ref: 00C33936

Strings

Invalid parameter, xrefs: 00C33865
NULL Pointer assignment, xrefs: 00C3381E
Failed to create object, xrefs: 00C337E4, 00C3389A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: d71e761e50d474483caffae0e3bd4e802c64125120224372f383395f541621bb
Instruction ID: cd95b3ed7cfd03a0d618136ee50b93edf642f46e313be9c095b5b32aae8a6787
Opcode Fuzzy Hash: d71e761e50d474483caffae0e3bd4e802c64125120224372f383395f541621bb
Instruction Fuzzy Hash: 3161BF74618341AFD310DF54C889FAABBE8EF49710F10495EF9959B2A1C770EE48CB92

Function 00C23388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00C233CF

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00C233F0

Strings

Incorrect parameters to object property !, xrefs: 00C234AB
"%s" (%d) : ==> %s:%s%s, xrefs: 00C23504
Line %d (File "%s"):, xrefs: 00C23443, 00C2345C
^ ERROR , xrefs: 00C2349E
"%s" (%d) : ==> %s:, xrefs: 00C23522
Error: , xrefs: 00C234D1

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 7eb0016f79b07d73f1b3c01beeca31b0823625ebc302cc2d31103e22a49f27d3
Instruction ID: 314a98f3583a995c591dda9bab6155b1a05acde39d79cd5877542f4297f416b8
Opcode Fuzzy Hash: 7eb0016f79b07d73f1b3c01beeca31b0823625ebc302cc2d31103e22a49f27d3
Instruction Fuzzy Hash: C4516F31900219ABDB15EBA0DD46EFEB7F8EF04740F1441A5B50972061DB756F98DB60

Function 00C1B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C1B5FC
_wcslen.LIBCMT ref: 00C1B608
_wcslen.LIBCMT ref: 00C1B64D
_wcslen.LIBCMT ref: 00C1B68C
_wcslen.LIBCMT ref: 00C1B6C7

Strings

EXISTS, xrefs: 00C1B686, 00C1B68B
KEYS, xrefs: 00C1B647, 00C1B64C
REMOVE, xrefs: 00C1B602, 00C1B607
APPEND, xrefs: 00C1B6C1, 00C1B6C6

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: f073f4dbd27d5f2d762610be2911a4707d00ad570fcf33ba084e31de4b638ed3
Instruction ID: b61fd795acfc1ffd46c506ec4a561ebe325993b3dab8e0081d2a636fbfe41eda
Opcode Fuzzy Hash: f073f4dbd27d5f2d762610be2911a4707d00ad570fcf33ba084e31de4b638ed3
Instruction Fuzzy Hash: 7741D632A001269BCB145F7D88905FEB7A5AF72794B244169F435D7284F735CEC1DB90

Function 00C25393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C253A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00C25416
GetLastError.KERNEL32 ref: 00C25420
SetErrorMode.KERNEL32(00000000,READY), ref: 00C254A7

Strings

INVALID, xrefs: 00C25459
READONLY, xrefs: 00C25452
NOTREADY, xrefs: 00C2544B
UNKNOWN, xrefs: 00C25444
READY, xrefs: 00C25460, 00C25468

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 4d06da961d65b6414c90cfe3ed7e1392316882f680a63e0505065193d07d3e2e
Instruction ID: 409a17e1fb92d06d816029032e1af2ddd615dc1edb75bed3995690f18cc791e5
Opcode Fuzzy Hash: 4d06da961d65b6414c90cfe3ed7e1392316882f680a63e0505065193d07d3e2e
Instruction Fuzzy Hash: 2431F075A006149FCB10EF68D884BEABBB4FF05305F148066E915CB6A2DB70DE82CB90

Function 00C43C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00C43C79
SetMenu.USER32(?,00000000), ref: 00C43C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C43D10
IsMenu.USER32(?), ref: 00C43D24
CreatePopupMenu.USER32 ref: 00C43D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C43D5B
DrawMenuBar.USER32 ref: 00C43D63

Strings

F, xrefs: 00C43D4E
0, xrefs: 00C43C54

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 40e74ca1be631e3d11052a784d63e46af551ef0b2487629a19b03286e4a1d0da
Instruction ID: 4cacafd5f344d7283464c4ac8955fae036bbb127cecca3d3f317ac7a6cfcb97d
Opcode Fuzzy Hash: 40e74ca1be631e3d11052a784d63e46af551ef0b2487629a19b03286e4a1d0da
Instruction Fuzzy Hash: EF415979A02209AFDB14CF64D888BAE7BB5FF89350F140029F956A7360D770AA10DF94

Function 00C11EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00C13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C13CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00C11F64
GetDlgCtrlID.USER32 ref: 00C11F6F
GetParent.USER32 ref: 00C11F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C11F8E
GetDlgCtrlID.USER32(?), ref: 00C11F97
GetParent.USER32(?), ref: 00C11FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C11FAE

Strings

ListBox, xrefs: 00C11F21
ComboBox, xrefs: 00C11EEC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 678517c1b5f8dac45c36150c8c64f52c92408dd327e59baee579ce48c3f75d75
Instruction ID: 6f8ca264b8b8ebb45e129f3770b6c2df25f715dd9eaf89067c6ac290da7f6796
Opcode Fuzzy Hash: 678517c1b5f8dac45c36150c8c64f52c92408dd327e59baee579ce48c3f75d75
Instruction Fuzzy Hash: 4B21C274900214BBCF04EFA0CC85EFEBBB8EF06350F104155FA65672A1DB785949EB60

Function 00C11FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00C13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C13CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00C12043
GetDlgCtrlID.USER32 ref: 00C1204E
GetParent.USER32 ref: 00C1206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C1206D
GetDlgCtrlID.USER32(?), ref: 00C12076
GetParent.USER32(?), ref: 00C1208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C1208D

Strings

ListBox, xrefs: 00C12002
ComboBox, xrefs: 00C11FCD

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 3b0caf795e9df173bfaa203d71c362ab0b18a111cc3dd74db4091148047bca1c
Instruction ID: fc0507ddc0924df6916d1306b40d7092161aa3373e885d38e5d78d0e35b3dd8f
Opcode Fuzzy Hash: 3b0caf795e9df173bfaa203d71c362ab0b18a111cc3dd74db4091148047bca1c
Instruction Fuzzy Hash: AF21A179901218BBCF14AFA0CC85FFEBBB8FF0A340F108155B955A72A1DA758954EB60

Function 00C43A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00C43A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00C43AA0
GetWindowLongW.USER32(?,000000F0), ref: 00C43AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C43AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00C43B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00C43BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00C43BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00C43BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00C43BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00C43C13

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 156b2a161b5de10e38d648569bbab12c39f57437244c24262d1143c737352567
Instruction ID: 76bf812ebc9c4da051c46df52e71eb0e08bbbbc03ddc8932d7b9d69d527101aa
Opcode Fuzzy Hash: 156b2a161b5de10e38d648569bbab12c39f57437244c24262d1143c737352567
Instruction Fuzzy Hash: 1D616675A00248AFDB10DFA8CC81FEE77F8FB49710F144199FA15A72A1C770AA46DB50

Function 00C1B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C1B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00C1A1E1,?,00000001), ref: 00C1B165
GetWindowThreadProcessId.USER32(00000000), ref: 00C1B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C1A1E1,?,00000001), ref: 00C1B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C1B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00C1A1E1,?,00000001), ref: 00C1B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C1A1E1,?,00000001), ref: 00C1B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00C1A1E1,?,00000001), ref: 00C1B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00C1A1E1,?,00000001), ref: 00C1B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00C1A1E1,?,00000001), ref: 00C1B21D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 5a16cd6cfd75da6988a48194e567e84ef98c1ab5998429bee73131cf5e0aca5c
Instruction ID: 5fae0942e819f8f69b0458a99dc0bbd8932c8c5978e3ea40b902d5bd8b291f7e
Opcode Fuzzy Hash: 5a16cd6cfd75da6988a48194e567e84ef98c1ab5998429bee73131cf5e0aca5c
Instruction Fuzzy Hash: A031DD75601204BFDB10AF64DC98FED7BA9BB63711F218004FA15DA1A0D7B89E849F68

Function 00BE2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BE2C94

Part of subcall function 00BE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000), ref: 00BE29DE
Part of subcall function 00BE29C8: GetLastError.KERNEL32(00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000,00000000), ref: 00BE29F0

_free.LIBCMT ref: 00BE2CA0
_free.LIBCMT ref: 00BE2CAB
_free.LIBCMT ref: 00BE2CB6
_free.LIBCMT ref: 00BE2CC1
_free.LIBCMT ref: 00BE2CCC
_free.LIBCMT ref: 00BE2CD7
_free.LIBCMT ref: 00BE2CE2
_free.LIBCMT ref: 00BE2CED
_free.LIBCMT ref: 00BE2CFB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fbd9e93e1eb44c2890cbd353b81c9ab0a163314c4b471441e012840ea08cea38
Instruction ID: 7f832721d1665246a310230547a32a041dc404610e9894536d33bc48754213ac
Opcode Fuzzy Hash: fbd9e93e1eb44c2890cbd353b81c9ab0a163314c4b471441e012840ea08cea38
Instruction Fuzzy Hash: 7911937A100148AFCB02EF56D882CDD3BA9FF05350F5254A5FA489B322DB39EA509B90

Function 00BB1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00BB1459
OleUninitialize.OLE32(?,00000000), ref: 00BB14F8
UnregisterHotKey.USER32(?), ref: 00BB16DD
DestroyWindow.USER32(?), ref: 00BF24B9
FreeLibrary.KERNEL32(?), ref: 00BF251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00BF254B

Strings

close all, xrefs: 00BB1454

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 88fe4c933c0b2fb5c251decd171f7c7d9bfb534b8c365d39d71f9b76542ee7d2
Instruction ID: b54f5754329c1fa144bdd395c15c119f733d4c8b3f56dd776c2c66d2417357f8
Opcode Fuzzy Hash: 88fe4c933c0b2fb5c251decd171f7c7d9bfb534b8c365d39d71f9b76542ee7d2
Instruction Fuzzy Hash: BFD168316022129FCB29EF18C8A9B79F7E4BF15700F5445EDE54AAB262CB70AD16CF50

Function 00C27DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C27FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00C27FC1
GetFileAttributesW.KERNEL32(?), ref: 00C27FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00C28005
SetCurrentDirectoryW.KERNEL32(?), ref: 00C28017
SetCurrentDirectoryW.KERNEL32(?), ref: 00C28060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C280B0

Strings

*.*, xrefs: 00C28066

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 53ab3266db12fc28959fbafe0449a55ad12ae2c7d408c02dd7e0c115ac10728f
Instruction ID: 7e0f77e323425064f2d46d4f24be92261b22408ae793561fb16716f083d40fe9
Opcode Fuzzy Hash: 53ab3266db12fc28959fbafe0449a55ad12ae2c7d408c02dd7e0c115ac10728f
Instruction Fuzzy Hash: 0981CF725082119FCB20EF15D880ABEB3E8BF89310F15499EF895C7650EB74DE48CB62

Function 00BB5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00BB5C7A

Part of subcall function 00BB5D0A: GetClientRect.USER32(?,?), ref: 00BB5D30
Part of subcall function 00BB5D0A: GetWindowRect.USER32(?,?), ref: 00BB5D71
Part of subcall function 00BB5D0A: ScreenToClient.USER32(?,?), ref: 00BB5D99

GetDC.USER32 ref: 00BF46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00BF4708
SelectObject.GDI32(00000000,00000000), ref: 00BF4716
SelectObject.GDI32(00000000,00000000), ref: 00BF472B
ReleaseDC.USER32(?,00000000), ref: 00BF4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00BF47C4

Strings

U, xrefs: 00BF4693

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: cf5698a62871a2bb1be84a609a530086dab194572b20b930185b23c3cf8928bc
Instruction ID: 168d25aadb360cf69b1ccce38cf3359937b7a9c56f9fc6722fbed237db997e4e
Opcode Fuzzy Hash: cf5698a62871a2bb1be84a609a530086dab194572b20b930185b23c3cf8928bc
Instruction Fuzzy Hash: 7F71BA34400209EFCF219F64C984BFA7BF6FF4A360F1842A9EA559B2A6C7709C45DB51

Function 00C2359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00C235E4

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

LoadStringW.USER32(00C82390,?,00000FFF,?), ref: 00C2360A

Strings

^ ERROR, xrefs: 00C236C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00C23724
Line %d (File "%s"):, xrefs: 00C2366B
"%s" (%d) : ==> %s:, xrefs: 00C23742
Error: , xrefs: 00C236EF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 48835b0ebbb39647c10cb8ad43f2ab39e9ba5d10122025826243dd9e6be1966a
Instruction ID: 43fdd88d30e17fda2e0d85528493623801b69f48b87dc13b6d99c9052783bb36
Opcode Fuzzy Hash: 48835b0ebbb39647c10cb8ad43f2ab39e9ba5d10122025826243dd9e6be1966a
Instruction Fuzzy Hash: 70516A71800219ABCF14EBA0DC82EFEBBB8EF04740F1441A5F505720A1EB705B99EFA4

Function 00C2C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C2C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C2C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C2C2CA
GetLastError.KERNEL32 ref: 00C2C322
SetEvent.KERNEL32(?), ref: 00C2C336
InternetCloseHandle.WININET(00000000), ref: 00C2C341

Strings

, xrefs: 00C2C2BB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 1cb546222e18bd81522cd01846393d9b4e709142b6b376a373edf52154164cdc
Instruction ID: 6611e395ee76f40ac32a1b6cdc6c55682e4eb07e3a016c48413939f40d9bd518
Opcode Fuzzy Hash: 1cb546222e18bd81522cd01846393d9b4e709142b6b376a373edf52154164cdc
Instruction Fuzzy Hash: 38319CB1500614AFD721DFA5A8C8BAF7AFCEB49740B10891AA45692620DB74DD049B60

Function 00C1989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00BF3AAF,?,?,Bad directive syntax error,00C4CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00C198BC
LoadStringW.USER32(00000000,?,00BF3AAF,?), ref: 00C198C3

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00C19987

Strings

., xrefs: 00C1996D
Line %d:, xrefs: 00C19912
Error: , xrefs: 00C19955
%s (%d) : ==> %s.: %s %s, xrefs: 00C198F1
Line %d (File "%s"):, xrefs: 00C1992D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 5587f06ef9e1318d4575dbd0cd29a040ed750921d410ad162f7f6708848e0f5e
Instruction ID: 69a1af26f095741c7d6af19b1254014bf8e10b848a39d3d99596492196da0c41
Opcode Fuzzy Hash: 5587f06ef9e1318d4575dbd0cd29a040ed750921d410ad162f7f6708848e0f5e
Instruction Fuzzy Hash: B5217E3180021ABBCF15AF90CC56EFE7BB5FF19700F0444A9F519660A2EBB19A58DB10

Function 00C1209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00C120AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00C120C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00C1214D

Strings

largeicons, xrefs: 00C120E1
list, xrefs: 00C1212F
SHELLDLL_DefView, xrefs: 00C120CC
details, xrefs: 00C120FB
smallicons, xrefs: 00C12115

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 0e49b6b4a0179441673d744c57fbef0bb6c42d40f5150509763cb068956cbf6f
Instruction ID: 87df851577149b32b7a61761e2388d99a6031fed9c205d29e35528f4768d1b53
Opcode Fuzzy Hash: 0e49b6b4a0179441673d744c57fbef0bb6c42d40f5150509763cb068956cbf6f
Instruction Fuzzy Hash: 78113A7E684706BBF605A220DC06DFE779CDB07324B305066FB08A40E1FBA15C916514

Function 00BE8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6364c9c21896e17ef59914a7515471d6cdb380bf87bfcc7974b2e8919b8af3
Instruction ID: b61104ddae5fdf8ac971a63d77b8778d64918b083a8f2ab15a28e21e554ceb94
Opcode Fuzzy Hash: cf6364c9c21896e17ef59914a7515471d6cdb380bf87bfcc7974b2e8919b8af3
Instruction Fuzzy Hash: 6EC1E074A04289AFDB11DFAAC881BADBBF0EF09310F5441D9F919AB393C7309945CB61

Function 00BECE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00BECEB7
_free.LIBCMT ref: 00BECF22
_free.LIBCMT ref: 00BECF48
_free.LIBCMT ref: 00BECF71
_free.LIBCMT ref: 00BECFA9
_free.LIBCMT ref: 00BECFDA
_free.LIBCMT ref: 00BED01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00BED09C
_free.LIBCMT ref: 00BED0B5

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 1b6536133b65070c620eafd8be89a9b1dc84dc6366eff8163411dd95d5db8dc3
Instruction ID: 7491396068312c92a3a0a9c278358dabb7f8cf52fbccc254aa35cfe73fb254a7
Opcode Fuzzy Hash: 1b6536133b65070c620eafd8be89a9b1dc84dc6366eff8163411dd95d5db8dc3
Instruction Fuzzy Hash: A8614572904294AFDB21AFB69891B6D7FE9EF05320F1441EEF90497383D7359D0A8790

Function 00C450D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00C45186
ShowWindow.USER32(?,00000000), ref: 00C451C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00C451CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00C451D1

Part of subcall function 00C46FBA: DeleteObject.GDI32(00000000), ref: 00C46FE6

GetWindowLongW.USER32(?,000000F0), ref: 00C4520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C4521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00C4524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00C45287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00C45296

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 00078fb5f5da09d7748566de893fd07db14f6f85e03f3a968f66527311932297
Instruction ID: 828e3677ec630333469b05fbd03790d3729eb5bc416031c3b060cef939558dac
Opcode Fuzzy Hash: 00078fb5f5da09d7748566de893fd07db14f6f85e03f3a968f66527311932297
Instruction Fuzzy Hash: 13519134A41A08FFEF309F25CC49BDD3BA5FB05321F148116FA25962E2C7B5AA80DB41

Function 00BC8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00C06890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00C068A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00C068B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00C068D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00C068F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00BC8874,00000000,00000000,00000000,000000FF,00000000), ref: 00C06901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00C0691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00BC8874,00000000,00000000,00000000,000000FF,00000000), ref: 00C0692D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: f595a9d709f3215acf92e7adcad656689b50127e8f239ff1f77c699e9c7289fd
Instruction ID: 83336b0f095f005bc39fdcb1c581b3f5a29e113ed5f022e44fe1f6996a726a3c
Opcode Fuzzy Hash: f595a9d709f3215acf92e7adcad656689b50127e8f239ff1f77c699e9c7289fd
Instruction Fuzzy Hash: A0516570600209AFEB208F24CC95FAA7BF5FB48760F104558F956972E0DB71AE91DB50

Function 00C2C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C2C182
GetLastError.KERNEL32 ref: 00C2C195
SetEvent.KERNEL32(?), ref: 00C2C1A9

Part of subcall function 00C2C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C2C272
Part of subcall function 00C2C253: GetLastError.KERNEL32 ref: 00C2C322
Part of subcall function 00C2C253: SetEvent.KERNEL32(?), ref: 00C2C336
Part of subcall function 00C2C253: InternetCloseHandle.WININET(00000000), ref: 00C2C341

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 2e0118ab5c7c7f4812316c387ddf06eaa4bf71270e380b8586ea0891a2cf7584
Instruction ID: b20ab6a616ac72410be9d64f5cb377f8daa4feef14744f2044d5a4367f3b6e2d
Opcode Fuzzy Hash: 2e0118ab5c7c7f4812316c387ddf06eaa4bf71270e380b8586ea0891a2cf7584
Instruction Fuzzy Hash: 66318E75201611EFDB219FA5ED84B6EBBF8FF19300B00441DF96683A20DB71E914EBA0

Function 00C125A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C13A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C13A57
Part of subcall function 00C13A3D: GetCurrentThreadId.KERNEL32 ref: 00C13A5E
Part of subcall function 00C13A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00C125B3), ref: 00C13A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00C125BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00C125DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00C125DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C125E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00C12601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00C12605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C1260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00C12623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00C12627

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 7f05702f6d4dbf18a781573c03e1b2a38f1a6d333dcc52a9d92f2c8c568b4efe
Instruction ID: c852768b4effc6d84100fca3e12930fa4acaa517b1191346c84da62220f842bb
Opcode Fuzzy Hash: 7f05702f6d4dbf18a781573c03e1b2a38f1a6d333dcc52a9d92f2c8c568b4efe
Instruction Fuzzy Hash: 6301D834791650BBFB1067699CCAF9D3F59EF4FB11F104001F318AE0E1C9E11454AAA9

Function 00C11803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00C11449,?,?,00000000), ref: 00C1180C
HeapAlloc.KERNEL32(00000000,?,00C11449,?,?,00000000), ref: 00C11813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00C11449,?,?,00000000), ref: 00C11828
GetCurrentProcess.KERNEL32(?,00000000,?,00C11449,?,?,00000000), ref: 00C11830
DuplicateHandle.KERNEL32(00000000,?,00C11449,?,?,00000000), ref: 00C11833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00C11449,?,?,00000000), ref: 00C11843
GetCurrentProcess.KERNEL32(00C11449,00000000,?,00C11449,?,?,00000000), ref: 00C1184B
DuplicateHandle.KERNEL32(00000000,?,00C11449,?,?,00000000), ref: 00C1184E
CreateThread.KERNEL32(00000000,00000000,00C11874,00000000,00000000,00000000), ref: 00C11868

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 145c4001431b4a696471c36ba92c63177701b28e586bd45cc89cb91715e720ed
Instruction ID: f97ac1a25f3113646b881a167be08c480673efa5413900c2d8b279dc182cc309
Opcode Fuzzy Hash: 145c4001431b4a696471c36ba92c63177701b28e586bd45cc89cb91715e720ed
Instruction Fuzzy Hash: 2D01AC75641304BFE650ABA5DC89F5F3B6CFB8AB11F014411FA05DB1A1C67498108B20

Function 00C3A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00C1D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00C1D501
Part of subcall function 00C1D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00C1D50F
Part of subcall function 00C1D4DC: CloseHandle.KERNEL32(00000000), ref: 00C1D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C3A16D
GetLastError.KERNEL32 ref: 00C3A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C3A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C3A268
GetLastError.KERNEL32(00000000), ref: 00C3A273
CloseHandle.KERNEL32(00000000), ref: 00C3A2C4

Strings

SeDebugPrivilege, xrefs: 00C3A18F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: dae749dae13d4d21b811556646418b3d0438e7460a395baf6700b13233727cdb
Instruction ID: 96539d7dd56494c6bb9aa2db72e2c6b7ac8f50763d1c9d21b4d8446f75b93f1b
Opcode Fuzzy Hash: dae749dae13d4d21b811556646418b3d0438e7460a395baf6700b13233727cdb
Instruction Fuzzy Hash: F861B2342142419FD710DF19C494F6ABBE1AF45318F18849CF4AA8B7A3C776ED49CB92

Function 00C43886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00C43925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00C4393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00C43954
_wcslen.LIBCMT ref: 00C43999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00C439C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00C439F4

Strings

SysListView32, xrefs: 00C438F7

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: acc47aaf3281e66b8b9341736f711f54c7e10ae41b821e0301b0e0f1c09c8cb0
Instruction ID: d034c33f6e17f346f4ca69ac7589583987e7682d6718b3006153ef17f1f21af9
Opcode Fuzzy Hash: acc47aaf3281e66b8b9341736f711f54c7e10ae41b821e0301b0e0f1c09c8cb0
Instruction Fuzzy Hash: 8541B371A00218ABEF219FA4CC49BEE7BA9FF58350F110526F958E7291D7719E84CB90

Function 00C1BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C1BCFD
IsMenu.USER32(00000000), ref: 00C1BD1D
CreatePopupMenu.USER32 ref: 00C1BD53
GetMenuItemCount.USER32(01716590), ref: 00C1BDA4
InsertMenuItemW.USER32(01716590,?,00000001,00000030), ref: 00C1BDCC

Strings

2, xrefs: 00C1BD37
0, xrefs: 00C1BCA8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 6be1ed370342ebc5cf137a1f00082f34c98b4bf67f8a5f0d8645de308b1140fd
Instruction ID: b7da2c08110ac3bbed348fbfdd7b1b2eef7aff500795eba2133d55b82ddd35bc
Opcode Fuzzy Hash: 6be1ed370342ebc5cf137a1f00082f34c98b4bf67f8a5f0d8645de308b1140fd
Instruction Fuzzy Hash: 80518C70A002059BDB18EFA9E8C4BEEBBF4BF5A314F144159F42197298D770AE81EF51

Function 00C1C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00C1C913

Strings

question, xrefs: 00C1C8CC
info, xrefs: 00C1C8B4
warning, xrefs: 00C1C8FC
stop, xrefs: 00C1C8E4
blank, xrefs: 00C1C895

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: b1efc7c0a58651d431da627ca1df9f48f4bd9fddef19ab2b1e4e61d02f12f711
Instruction ID: 7c273e90510e8c804b14a67dcde2dfefc66a3e763a785ee3426de0b29ea68960
Opcode Fuzzy Hash: b1efc7c0a58651d431da627ca1df9f48f4bd9fddef19ab2b1e4e61d02f12f711
Instruction Fuzzy Hash: 8E1127326C9706BBA7049B559CC3DEE67DCDF17364F20407BF504AA2C2E7B05E806268

Function 00C1DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00C1DE42
gethostname.WSOCK32(?,00000100), ref: 00C1DE5C
gethostbyname.WSOCK32(?), ref: 00C1DE69
inet_ntoa.WSOCK32(?), ref: 00C1DEAB
_strcat.LIBCMT ref: 00C1DEB9
WSACleanup.WSOCK32 ref: 00C1DEDE

Strings

0.0.0.0, xrefs: 00C1DE87

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 3c6bdf073ed791f51f01740c9e864846a2ed29eb18883e73e5132266c1fe4e5f
Instruction ID: 6030055b7305eba7aed313020a9ba0e8e84091775b38aa12e0c138ef51bbf2f9
Opcode Fuzzy Hash: 3c6bdf073ed791f51f01740c9e864846a2ed29eb18883e73e5132266c1fe4e5f
Instruction Fuzzy Hash: AE110631904105AFCB24AB719C4AFEE77ACEF12711F0001AAF4569A1A1FF748AC1DA50

Function 00C49F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BC9BB2

GetSystemMetrics.USER32(0000000F), ref: 00C49FC7
GetSystemMetrics.USER32(0000000F), ref: 00C49FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00C4A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00C4A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00C4A263
ShowWindow.USER32(00000003,00000000), ref: 00C4A282
InvalidateRect.USER32(?,00000000,00000001), ref: 00C4A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00C4A2CA

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 164a7a26116709921a00627dd833f6ba907f3ad91158dfffcd8c5286d7ffb8fd
Instruction ID: 021b9413b6e302a904d70a89a29558d1aa7e9d7317ade5ccbaee7eeef4915806
Opcode Fuzzy Hash: 164a7a26116709921a00627dd833f6ba907f3ad91158dfffcd8c5286d7ffb8fd
Instruction Fuzzy Hash: 33B1B831640215EFDF24CF68C9C5BAE3BB2FF48701F088169EC59AB295D771AA40DB51

Function 00C1ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00C1ED2A
_wcslen.LIBCMT ref: 00C1ED3B
_wcslen.LIBCMT ref: 00C1ED79
_wcslen.LIBCMT ref: 00C1EDAF
_wcslen.LIBCMT ref: 00C1EDDF
_wcslen.LIBCMT ref: 00C1EDEF
_wcslen.LIBCMT ref: 00C1EE2B
_wcslen.LIBCMT ref: 00C1EE5A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: ad327767fc94c9fc46ab0115570b42132214c0df043cdca52109c3a834195a39
Instruction ID: 1276285495151e985199b5b9c2f51834600915ef5f13e358d4aace88e64ae435
Opcode Fuzzy Hash: ad327767fc94c9fc46ab0115570b42132214c0df043cdca52109c3a834195a39
Instruction Fuzzy Hash: 60416065C1021866CB11EBB4CC8A9CFB7E8AF46710F5085A7E918E3221FB34E695C7E5

Function 00BCF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00C0682C,00000004,00000000,00000000), ref: 00BCF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00C0682C,00000004,00000000,00000000), ref: 00C0F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00C0682C,00000004,00000000,00000000), ref: 00C0F454

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 6f087975c4abe8413a8a169a3c320568b2981c828f60b15f806654c11813d7a2
Instruction ID: 1fccb46d16567e4cf58fa1d74b68f6d91d6ad1b527eb16e74f134f6dc3253059
Opcode Fuzzy Hash: 6f087975c4abe8413a8a169a3c320568b2981c828f60b15f806654c11813d7a2
Instruction Fuzzy Hash: 21411630608681BACF788B6988C8F7E7BD3BB46320F1444FCE487569B0C6B1E981CB11

Function 00C42D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C42D1B
GetDC.USER32(00000000), ref: 00C42D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C42D2E
ReleaseDC.USER32(00000000,00000000), ref: 00C42D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00C42D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00C42D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00C45A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00C42DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00C42DE1

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: c348c9f0fe10307c574ad634a300b470756704eff09b23b1483f5b2beba25b4e
Instruction ID: c729d4cc67ccd5bb628aa431b7f4490e390e324c854db61f43190b03a13cf193
Opcode Fuzzy Hash: c348c9f0fe10307c574ad634a300b470756704eff09b23b1483f5b2beba25b4e
Instruction Fuzzy Hash: 6C317A76202614BFEB218F50CC8AFEB3FA9FF0A715F044055FE089A2A1C6759C50CBA4

Function 00C15622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00C15637
_memcmp.LIBVCRUNTIME ref: 00C15659
_memcmp.LIBVCRUNTIME ref: 00C15671
_memcmp.LIBVCRUNTIME ref: 00C15684
_memcmp.LIBVCRUNTIME ref: 00C1569E
_memcmp.LIBVCRUNTIME ref: 00C156B1
_memcmp.LIBVCRUNTIME ref: 00C156C9
_memcmp.LIBVCRUNTIME ref: 00C156E4

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 64d5607eaf01e16cc3c5ec1c2555d437c1c8acc016867a3ad69ce4c9b5180efa
Instruction ID: 7ec880cce08dba1748ee74a75b8774a7e3a0d14ea1c9ba7411678af6261ae6d0
Opcode Fuzzy Hash: 64d5607eaf01e16cc3c5ec1c2555d437c1c8acc016867a3ad69ce4c9b5180efa
Instruction Fuzzy Hash: B921F661B40A09FBD2145A258E82FFA739CFFA3394F440035FD049A782F760EE51A1E9

Function 00C34FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00C35007
NULL Pointer assignment, xrefs: 00C3502E, 00C35383

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 65965e6ece27744ee7611179b0eb58e7ef2304fec9b86edefaf88d634397309d
Instruction ID: 1acaac62a93dda31597fa79565b742668eb3ba576f0fe965423f261881805a46
Opcode Fuzzy Hash: 65965e6ece27744ee7611179b0eb58e7ef2304fec9b86edefaf88d634397309d
Instruction Fuzzy Hash: C6D1E375A1060A9FDF14CFA8C880FAEB7B5FF48344F148069E925AB291E771DE41CB90

Function 00BF1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00BF15CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00BF1651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BF16E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00BF16FB

Part of subcall function 00BE3820: RtlAllocateHeap.NTDLL(00000000,?,00C81444,?,00BCFDF5,?,?,00BBA976,00000010,00C81440,00BB13FC,?,00BB13C6,?,00BB1129), ref: 00BE3852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BF1777
__freea.LIBCMT ref: 00BF17A2
__freea.LIBCMT ref: 00BF17AE

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: aec4bf137ecbb50699bf0e196628c22bc714bb06998873947beb04fc7125c72f
Instruction ID: 3d4bd42a5b8511c6b82e6c67976d1b1a64111241d60b5d075b2e2d1451842bd5
Opcode Fuzzy Hash: aec4bf137ecbb50699bf0e196628c22bc714bb06998873947beb04fc7125c72f
Instruction Fuzzy Hash: 1091B271E0021ADADB209E78C881AFEBBF5EF59310F184E99EA05E7151D735DC48CB60

Function 00C34523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C34648
VariantInit.OLEAUT32(?), ref: 00C34749
VariantClear.OLEAUT32(?), ref: 00C34753
VariantClear.OLEAUT32(?), ref: 00C347B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00C3472C
Null Object assignment in FOR..IN loop, xrefs: 00C345D8, 00C34706, 00C347BE

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 9cc61eafdd5110054b0ee0b17dc491a1ce57df555104595e1628c9456bf8a88e
Instruction ID: 88c44d1c96ccfca649eb3b03b9aa646129af0f10800e139bcd571cf38689e36b
Opcode Fuzzy Hash: 9cc61eafdd5110054b0ee0b17dc491a1ce57df555104595e1628c9456bf8a88e
Instruction Fuzzy Hash: 4991A171E10219AFDF28CFA5C885FAEBBB8EF46710F108559F515AB290D770A941CFA0

Function 00C21187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00C2125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00C21284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00C212A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C212D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C2135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C213C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C21430

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 9763bed5fb501c0389d8b25e8532ac035250e37fb21bc3e0dcf007c74144e2a1
Instruction ID: 9b968fdd06d29f27c15fe53de03658187fe99d425e12d92821fd00c02d254b03
Opcode Fuzzy Hash: 9763bed5fb501c0389d8b25e8532ac035250e37fb21bc3e0dcf007c74144e2a1
Instruction Fuzzy Hash: CD911475A002289FDB00DFA8E884BBEB7F5FF55320F294069E910E76A1D774E941CB90

Function 00BC948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 3a37cb0d2371aadced3aa97b9130f81d01a59a6aaaf9991b00221775c415287b
Instruction ID: 0c8ed45b7a97bdbc7ce678e7dd742161774d79ce4e658c9058f5d18b79444315
Opcode Fuzzy Hash: 3a37cb0d2371aadced3aa97b9130f81d01a59a6aaaf9991b00221775c415287b
Instruction Fuzzy Hash: F9910671D00219EFDB14CFA9CC88AEEBBB8FF49320F148599E515B7291D774AA41CB60

Function 00C33947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C3396B
CharUpperBuffW.USER32(?,?), ref: 00C33A7A
_wcslen.LIBCMT ref: 00C33A8A
VariantClear.OLEAUT32(?), ref: 00C33C1F

Part of subcall function 00C20CDF: VariantInit.OLEAUT32(00000000), ref: 00C20D1F
Part of subcall function 00C20CDF: VariantCopy.OLEAUT32(?,?), ref: 00C20D28
Part of subcall function 00C20CDF: VariantClear.OLEAUT32(?), ref: 00C20D34

Strings

Incorrect Parameter format, xrefs: 00C339A6, 00C33BA1
AUTOIT.ERROR, xrefs: 00C33A80, 00C33A85

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 9cded7a764edffbeb4b84774fbad798a1dc90f3e4c648160142055d397341501
Instruction ID: 452b91e32236bcef43abd403413ee7f7b28dbc2f11796472f1a95f9c9d02e08f
Opcode Fuzzy Hash: 9cded7a764edffbeb4b84774fbad798a1dc90f3e4c648160142055d397341501
Instruction Fuzzy Hash: E4919974A183459FC700EF68C48096ABBE4FF89314F14896DF89A9B351DB30EE45CB92

Function 00C34BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00C1000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C0FF41,80070057,?,?,?,00C1035E), ref: 00C1002B
Part of subcall function 00C1000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C0FF41,80070057,?,?), ref: 00C10046
Part of subcall function 00C1000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C0FF41,80070057,?,?), ref: 00C10054
Part of subcall function 00C1000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C0FF41,80070057,?), ref: 00C10064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00C34C51
_wcslen.LIBCMT ref: 00C34D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00C34DCF
CoTaskMemFree.OLE32(?), ref: 00C34DDA

Strings

NULL Pointer assignment, xrefs: 00C34E23, 00C34E52

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: d713c6165b6a0701d1f9ef033d39bffa6147be4c02d9e808cd68c4ed289ea09a
Instruction ID: 8edff46aea1f493944c9abfca74bc071ea240d3fa230712aa5fd1b6ab10e46a5
Opcode Fuzzy Hash: d713c6165b6a0701d1f9ef033d39bffa6147be4c02d9e808cd68c4ed289ea09a
Instruction Fuzzy Hash: A7910771D0021DAFDF14DFA4D891AEEB7B9FF08310F10416AE915A7291EB74AA45CF60

Function 00C420FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00C42183
GetMenuItemCount.USER32(00000000), ref: 00C421B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00C421DD
_wcslen.LIBCMT ref: 00C42213
GetMenuItemID.USER32(?,?), ref: 00C4224D
GetSubMenu.USER32(?,?), ref: 00C4225B

Part of subcall function 00C13A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C13A57
Part of subcall function 00C13A3D: GetCurrentThreadId.KERNEL32 ref: 00C13A5E
Part of subcall function 00C13A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00C125B3), ref: 00C13A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C422E3

Part of subcall function 00C1E97B: Sleep.KERNELBASE ref: 00C1E9F3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: f673dcb8d840c48eb0878b09a159cefdb5715730edb3f413e44d44dc94d3fde1
Instruction ID: 2172d19f042bc5a8af64bba9afdae7117ecbd5d405e88a18f814b114c88d7572
Opcode Fuzzy Hash: f673dcb8d840c48eb0878b09a159cefdb5715730edb3f413e44d44dc94d3fde1
Instruction Fuzzy Hash: BE718075A00205AFCB10DF65C886AAEBBF5FF49320F508499F816EB351DB74AE41DB90

Function 00C47E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(017163D8), ref: 00C47F37
IsWindowEnabled.USER32(017163D8), ref: 00C47F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00C4801E
SendMessageW.USER32(017163D8,000000B0,?,?), ref: 00C48051
IsDlgButtonChecked.USER32(?,?), ref: 00C48089
GetWindowLongW.USER32(017163D8,000000EC), ref: 00C480AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00C480C3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: e070f0ebb868b8df74b48635e33916ff98c4a5a37f973303533c0b09e6d7fe13
Instruction ID: 0783537bff857d8fdc08fbaa778a8b47154a183de4d69cfddc40cf9f4ed42d10
Opcode Fuzzy Hash: e070f0ebb868b8df74b48635e33916ff98c4a5a37f973303533c0b09e6d7fe13
Instruction Fuzzy Hash: A6715E34609204AFEB219FA4C894FEE7BB9FF09310F14455AF96597261CB31AE49DB20

Function 00C1AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00C1AEF9
GetKeyboardState.USER32(?), ref: 00C1AF0E
SetKeyboardState.USER32(?), ref: 00C1AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00C1AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00C1AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00C1AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00C1B020

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: a8891191cc108e4ac12d5943c2f0a61979b7aacb2ad69c1524eef3a7288fec5c
Instruction ID: b1fb1c8d93515f1ec822db7b5add68a817ead89fb22779229450a705432392a4
Opcode Fuzzy Hash: a8891191cc108e4ac12d5943c2f0a61979b7aacb2ad69c1524eef3a7288fec5c
Instruction Fuzzy Hash: 6051E3E06057D53DFB3682748C45BFA7EA95B07304F088489F1E9454D2C3E8AED9E761

Function 00C1ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00C1AD19
GetKeyboardState.USER32(?), ref: 00C1AD2E
SetKeyboardState.USER32(?), ref: 00C1AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00C1ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00C1ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00C1AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00C1AE38

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 816ccdbd261a7dc85f37f938e78c3ee7452845756964bf8c2ca6394e23c7e798
Instruction ID: 1f0a8ed6ef9f03f332f5b2ef9954dcaa650d02cb6db454f978344b37f0dafa60
Opcode Fuzzy Hash: 816ccdbd261a7dc85f37f938e78c3ee7452845756964bf8c2ca6394e23c7e798
Instruction Fuzzy Hash: FF51D6A1505BD53DFB3692348C95BFA7EA86F47300F088488F1E5468C2C2A4EDD8F752

Function 00BE542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00BF3CD6,?,?,?,?,?,?,?,?,00BE5BA3,?,?,00BF3CD6,?,?), ref: 00BE5470
__fassign.LIBCMT ref: 00BE54EB
__fassign.LIBCMT ref: 00BE5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00BF3CD6,00000005,00000000,00000000), ref: 00BE552C
WriteFile.KERNEL32(?,00BF3CD6,00000000,00BE5BA3,00000000,?,?,?,?,?,?,?,?,?,00BE5BA3,?), ref: 00BE554B
WriteFile.KERNEL32(?,?,00000001,00BE5BA3,00000000,?,?,?,?,?,?,?,?,?,00BE5BA3,?), ref: 00BE5584

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: da82b8f8ae95301ccf991dc6c023ae4f06cf8bb37bbdfce9070548a58cbea805
Instruction ID: 6162dfb22294cb8b5aaffc90e5bc6f3b0e24a53d48cc602294292089d955630d
Opcode Fuzzy Hash: da82b8f8ae95301ccf991dc6c023ae4f06cf8bb37bbdfce9070548a58cbea805
Instruction Fuzzy Hash: 7551F471A006899FDB20CFA9D885BEEBBF9EF19304F24409AF555E7291D7309A40CB60

Function 00BD2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BD2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00BD2D53
_ValidateLocalCookies.LIBCMT ref: 00BD2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00BD2E0C
_ValidateLocalCookies.LIBCMT ref: 00BD2E61

Strings

csm, xrefs: 00BD2DF6

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c419d2af95f263ba532b42430ea133035979d89f90bc34cc8eb5bc5755889fbb
Instruction ID: a01c9b027126cf70e3c9ef2939fa97fecea2d500887cb98abfb466010de5021e
Opcode Fuzzy Hash: c419d2af95f263ba532b42430ea133035979d89f90bc34cc8eb5bc5755889fbb
Instruction Fuzzy Hash: 9641B534A002499BCF10DF68C885A9EFBF5FF54354F1481E6E815AB392E7329A15CBD1

Function 00C310B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C3304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C3307A
Part of subcall function 00C3304E: _wcslen.LIBCMT ref: 00C3309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00C31112
WSAGetLastError.WSOCK32 ref: 00C31121
WSAGetLastError.WSOCK32 ref: 00C311C9
closesocket.WSOCK32(00000000), ref: 00C311F9

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 83a9406017701db614ca384e1f0274c143762dceeeab35b1e193ad58c9e1caf4
Instruction ID: 7521c806c990bf5e838fb69f98daa1fb1b3e764acffea580bb258fcee6850c13
Opcode Fuzzy Hash: 83a9406017701db614ca384e1f0274c143762dceeeab35b1e193ad58c9e1caf4
Instruction Fuzzy Hash: B741C135610204AFDB109F14C885BEEBBE9FF45364F188059FD1A9B2A2C774AE41CBA1

Function 00C1CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C1CF22,?), ref: 00C1DDFD

Part of subcall function 00C1DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C1CF22,?), ref: 00C1DE16

lstrcmpiW.KERNEL32(?,?), ref: 00C1CF45
MoveFileW.KERNEL32(?,?), ref: 00C1CF7F
_wcslen.LIBCMT ref: 00C1D005
_wcslen.LIBCMT ref: 00C1D01B
SHFileOperationW.SHELL32(?), ref: 00C1D061

Strings

\*.*, xrefs: 00C1CFF3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 215b4fac5fa786e0cb9dcb027ca29b225f5b354832ffa61c40342e4a7e2a846c
Instruction ID: 53deee3223e67f2f647b0e1484e30a06450f109ec8b94702907289dd30d46682
Opcode Fuzzy Hash: 215b4fac5fa786e0cb9dcb027ca29b225f5b354832ffa61c40342e4a7e2a846c
Instruction Fuzzy Hash: 3D4133719452199FDF12EFA4D9C1AEEB7F9AF09380F1000E6E505EB142EB34A789DB50

Function 00C42DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00C42E1C
GetWindowLongW.USER32(?,000000F0), ref: 00C42E4F
GetWindowLongW.USER32(?,000000F0), ref: 00C42E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00C42EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00C42EE0
GetWindowLongW.USER32(?,000000F0), ref: 00C42EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C42F0B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: e8f2fbc3488d02ad3c1894c74d64f33585c4f5e2237cb295f1241debe254cf9f
Instruction ID: ac2819eed9b3a6e119cdab76613c8ff062d4db27dd0be6ba3465674732e89f10
Opcode Fuzzy Hash: e8f2fbc3488d02ad3c1894c74d64f33585c4f5e2237cb295f1241debe254cf9f
Instruction Fuzzy Hash: E93126346051509FEB20CF58DC86FA937E4FB4A721F990164F9248F2B2CB71AD41EB00

Function 00C17726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C17769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C1778F
SysAllocString.OLEAUT32(00000000), ref: 00C17792
SysAllocString.OLEAUT32(?), ref: 00C177B0
SysFreeString.OLEAUT32(?), ref: 00C177B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00C177DE
SysAllocString.OLEAUT32(?), ref: 00C177EC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4399b2a46b387a6c117b707acaf87a0b47fff0dc477f5cd715761fa28672032c
Instruction ID: 727df8081d579f7ea56fed87806d58385d0c1dc6fb2b7239f650cc3f4d535049
Opcode Fuzzy Hash: 4399b2a46b387a6c117b707acaf87a0b47fff0dc477f5cd715761fa28672032c
Instruction Fuzzy Hash: 2921D33A604209AFDB01DFA8CC84EFF73ACFB0A360B008165B915CB1A0D670DD81D7A0

Function 00C177FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C17842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C17868
SysAllocString.OLEAUT32(00000000), ref: 00C1786B
SysAllocString.OLEAUT32 ref: 00C1788C
SysFreeString.OLEAUT32 ref: 00C17895
StringFromGUID2.OLE32(?,?,00000028), ref: 00C178AF
SysAllocString.OLEAUT32(?), ref: 00C178BD

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 129f5e87bd10c88b01228c5e41534787f2564c57f609cd6d546ff4746029df31
Instruction ID: 76dbd48361b07f6f5a9efe56166b992cfe7913a99c4e0dc6efcf655c72952f15
Opcode Fuzzy Hash: 129f5e87bd10c88b01228c5e41534787f2564c57f609cd6d546ff4746029df31
Instruction Fuzzy Hash: 32218135605105AFEB10AFA8DC88EFA77FCFB0A3607108125B915DB2A1D674DD81DB74

Function 00C204D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00C204F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C2052E

Strings

nul, xrefs: 00C20567

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 62f9d49257467d04f487e5307ca0e7a404e4d94c995fc5d7b0d05a3b43b20090
Instruction ID: eb9b7ee3666828e836199bdb1b4f60d1a3d118ae0872a74688514c18fc09b44b
Opcode Fuzzy Hash: 62f9d49257467d04f487e5307ca0e7a404e4d94c995fc5d7b0d05a3b43b20090
Instruction Fuzzy Hash: 372182756003199BDB208F29EC44B9A77F4BF45724F304A2AF8B1D61E2D7B09A40CF64

Function 00C205A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00C205C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C20601

Strings

nul, xrefs: 00C20639

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: f40c0262b08fa8e6c10919f7874c759484334dc370db4ca2ff2d2166611ad4c0
Instruction ID: cfecf59dd78d090371166fc32970138286e870706d596eba9e7259a0f2e10418
Opcode Fuzzy Hash: f40c0262b08fa8e6c10919f7874c759484334dc370db4ca2ff2d2166611ad4c0
Instruction Fuzzy Hash: C2214F756003259FDB209F69AC44B9A77E4BF95721F300A1AFCB1E76E2D7B09960CB10

Function 00C440AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00BB604C
Part of subcall function 00BB600E: GetStockObject.GDI32(00000011), ref: 00BB6060
Part of subcall function 00BB600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BB606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00C44112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00C4411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00C4412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00C44139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00C44145

Strings

Msctls_Progress32, xrefs: 00C440E3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 3718a4bfeb54fd9a8279adca96acd9811992b79b59f1828027762270dde360db
Instruction ID: ca3b3842702419fe030012ed8ec3cba908d19174934ef0db6f5ca8e5056bff29
Opcode Fuzzy Hash: 3718a4bfeb54fd9a8279adca96acd9811992b79b59f1828027762270dde360db
Instruction Fuzzy Hash: C91193B114011D7EEF119E64CC85EEB7F9DFF09798F114111FA18A2050C6729C21DBA4

Function 00BED7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BED7A3: _free.LIBCMT ref: 00BED7CC

_free.LIBCMT ref: 00BED82D

Part of subcall function 00BE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000), ref: 00BE29DE
Part of subcall function 00BE29C8: GetLastError.KERNEL32(00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000,00000000), ref: 00BE29F0

_free.LIBCMT ref: 00BED838
_free.LIBCMT ref: 00BED843
_free.LIBCMT ref: 00BED897
_free.LIBCMT ref: 00BED8A2
_free.LIBCMT ref: 00BED8AD
_free.LIBCMT ref: 00BED8B8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 4059972c3297005db9ef4f86bc082019e39afb7954e83333b41d8a487007714f
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 31113071540B88BAD621BFF2CC47FCB7BDCAF04700F404865B699A6593DBB9B9058760

Function 00C1DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00C1DA74
LoadStringW.USER32(00000000), ref: 00C1DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00C1DA91
LoadStringW.USER32(00000000), ref: 00C1DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00C1DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00C1DAB9

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: cd9fb56ccd183fb8abf1364938d291c68f2fc97ef437a23c49633cbea051a53a
Instruction ID: 5c61e1ad1b58b22836a0d77a5a2221593466d1d52679af608f5ab969022a829a
Opcode Fuzzy Hash: cd9fb56ccd183fb8abf1364938d291c68f2fc97ef437a23c49633cbea051a53a
Instruction Fuzzy Hash: D80162F65002087FE750DBA09DC9FEB366CEB09701F404491B706E2051EA749E845F74

Function 00C2096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0170DED8,0170DED8), ref: 00C2097B
EnterCriticalSection.KERNEL32(0170DEB8,00000000), ref: 00C2098D
TerminateThread.KERNEL32(?,000001F6), ref: 00C2099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00C209A9
CloseHandle.KERNEL32(?), ref: 00C209B8
InterlockedExchange.KERNEL32(0170DED8,000001F6), ref: 00C209C8
LeaveCriticalSection.KERNEL32(0170DEB8), ref: 00C209CF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 010e2e76766b5b1d7b5df08ee681995b4faa1b2940198850f7a2360b43c4c6d8
Instruction ID: 9deb6116d5c797c6698d7a47d05a7258570750e95d48a9bb9c8513ec524393d9
Opcode Fuzzy Hash: 010e2e76766b5b1d7b5df08ee681995b4faa1b2940198850f7a2360b43c4c6d8
Instruction Fuzzy Hash: 6AF0CD35543A12ABD7916F94EEC9BDA7A25BF06702F501016F102508B1C7B59575CF90

Function 00BB5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BB5D30
GetWindowRect.USER32(?,?), ref: 00BB5D71
ScreenToClient.USER32(?,?), ref: 00BB5D99
GetClientRect.USER32(?,?), ref: 00BB5ED7
GetWindowRect.USER32(?,?), ref: 00BB5EF8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 750392e45a829af6efae4200b1421bf1272c8fd261bb0ae919d73c5bb99d1c49
Instruction ID: b19120aef9db94e6da08c9ec93d5eaeff525eeba8f0aae2bf8e96e43b990374d
Opcode Fuzzy Hash: 750392e45a829af6efae4200b1421bf1272c8fd261bb0ae919d73c5bb99d1c49
Instruction Fuzzy Hash: 58B15538A00A4ADBDB20CFA8C4807FAB7F1FF48310F14855AE9A9D7250DB74EA51DB55

Function 00BE01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00BE00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BE00D6
__allrem.LIBCMT ref: 00BE00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BE010B
__allrem.LIBCMT ref: 00BE0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BE0140

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 160118b9ee8a84aac45e35bdc8f8ddf4ce34e2b074d8795d30aa982607da0962
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 008107716017469BE720AF6ACC81B6BB3E9EF41324F2446BEF511DB381E7B0D9408795

Function 00C31D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C33149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00C3101C,00000000,?,?,00000000), ref: 00C33195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00C31DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00C31DE1
WSAGetLastError.WSOCK32 ref: 00C31DF2
inet_ntoa.WSOCK32(?), ref: 00C31E8C
htons.WSOCK32(?,?,?,?,?), ref: 00C31EDB
_strlen.LIBCMT ref: 00C31F35

Part of subcall function 00C139E8: _strlen.LIBCMT ref: 00C139F2

Part of subcall function 00BB6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00BCCF58,?,?,?), ref: 00BB6DBA
Part of subcall function 00BB6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00BCCF58,?,?,?), ref: 00BB6DED

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 7b2affd9e785cf3971bbce7cdda8cac9d9603a1a0700a0466a9cad2a518cb37c
Instruction ID: 19f9fda30d5e4129ccbce394c345c27110e05708cff92f2de85655a408ce0211
Opcode Fuzzy Hash: 7b2affd9e785cf3971bbce7cdda8cac9d9603a1a0700a0466a9cad2a518cb37c
Instruction Fuzzy Hash: E6A1C130114340AFC324DF64C895F7A77E5AF89318F58899CF8565B2A2CB71EE46CB91

Function 00BE61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00BD82D9,00BD82D9,?,?,?,00BE644F,00000001,00000001,8BE85006), ref: 00BE6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00BE644F,00000001,00000001,8BE85006,?,?,?), ref: 00BE62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00BE63D8
__freea.LIBCMT ref: 00BE63E5

Part of subcall function 00BE3820: RtlAllocateHeap.NTDLL(00000000,?,00C81444,?,00BCFDF5,?,?,00BBA976,00000010,00C81440,00BB13FC,?,00BB13C6,?,00BB1129), ref: 00BE3852

__freea.LIBCMT ref: 00BE63EE
__freea.LIBCMT ref: 00BE6413

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 714e7f55b789803b47fc829dc464ce864725d7e3e8aad1f88eae6506d32e5b42
Instruction ID: 47a22418d947e61771dac801c1f360b83ce1684495dfe88607ff16b202d488fa
Opcode Fuzzy Hash: 714e7f55b789803b47fc829dc464ce864725d7e3e8aad1f88eae6506d32e5b42
Instruction Fuzzy Hash: C251E372600296ABDB258F6ACC81FBF77E9EB64790F1446A9FD05D7180EB34DC40C664

Function 00C3BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00C3C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C3B6AE,?,?), ref: 00C3C9B5
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3C9F1
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3CA68
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C3BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C3BD25
RegCloseKey.ADVAPI32(00000000), ref: 00C3BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00C3BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C3BDF3
RegCloseKey.ADVAPI32(?), ref: 00C3BDFF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 70baa90fd8009245cb66eabacf852ee56cf9b93655dc54c91b043ede545d094b
Instruction ID: 2cc13e1d8d6a93d283522122b4e4458d6276f1c721992fc3397f3581849ae029
Opcode Fuzzy Hash: 70baa90fd8009245cb66eabacf852ee56cf9b93655dc54c91b043ede545d094b
Instruction Fuzzy Hash: B781B130218241EFC714DF24C891E6ABBE5FF84308F14859DF55A4B2A2DB31ED45CB92

Function 00C0F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00C0F7B9
SysAllocString.OLEAUT32(00000001), ref: 00C0F860
VariantCopy.OLEAUT32(00C0FA64,00000000), ref: 00C0F889
VariantClear.OLEAUT32(00C0FA64), ref: 00C0F8AD
VariantCopy.OLEAUT32(00C0FA64,00000000), ref: 00C0F8B1
VariantClear.OLEAUT32(?), ref: 00C0F8BB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 639fd0e0917b9418cebb79427d64f32135532628bdffc27295898b8e2ce515e7
Instruction ID: dc7955f991a5c4da7eb595dda7812d9652abc61a0698ff1bc696485ef2d72ad1
Opcode Fuzzy Hash: 639fd0e0917b9418cebb79427d64f32135532628bdffc27295898b8e2ce515e7
Instruction Fuzzy Hash: DC51E735600310BBCF34AB65D895B79B3E8EF45310B24946EE906DF6D1DB708C82D7A6

Function 00C2910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00BB7620: _wcslen.LIBCMT ref: 00BB7625

Part of subcall function 00BB6B57: _wcslen.LIBCMT ref: 00BB6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00C294E5
_wcslen.LIBCMT ref: 00C29506
_wcslen.LIBCMT ref: 00C2952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00C29585

Strings

X, xrefs: 00C29412

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 5ca19b1fbfb5fe9d5deb60561f3affd3ee3b6b7fd8b3c8870e7b39c8ab352424
Instruction ID: fc7bfac5e7f24e5a8c96209662e245a456cb22391e48edee0c03941e1963839e
Opcode Fuzzy Hash: 5ca19b1fbfb5fe9d5deb60561f3affd3ee3b6b7fd8b3c8870e7b39c8ab352424
Instruction Fuzzy Hash: 6CE1A1316083109FD724DF24D881AAAB7E4FF85310F1489ADF8999B2A2DB71DD45CB92

Function 00BC920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00BC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BC9BB2

BeginPaint.USER32(?,?,?), ref: 00BC9241
GetWindowRect.USER32(?,?), ref: 00BC92A5
ScreenToClient.USER32(?,?), ref: 00BC92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00BC92D3
EndPaint.USER32(?,?,?,?,?), ref: 00BC9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00C071EA

Part of subcall function 00BC9339: BeginPath.GDI32(00000000), ref: 00BC9357

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 67c409740544a4ef90c2bfc87f29002edcd1b299ff3f4d3b0119be3902ad73bb
Instruction ID: e892a5540dc3e3816e3f62f792120e9a9e4cad3c0c12b7f2c041a938b911e5e0
Opcode Fuzzy Hash: 67c409740544a4ef90c2bfc87f29002edcd1b299ff3f4d3b0119be3902ad73bb
Instruction Fuzzy Hash: 18419D71105200AFE710DF24DCC8FAA7BE8FB46320F0406A9F9A4872F1C7319945DB61

Function 00C207EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00C2080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00C20847
EnterCriticalSection.KERNEL32(?), ref: 00C20863
LeaveCriticalSection.KERNEL32(?), ref: 00C208DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00C208F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00C20921

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 0a758a3ecb8424518bc5823fdcc31f42a7c970e8bf4c98195f78cc6d516cd704
Instruction ID: bfabfbf2c03b4089db9c8ae7f076b08d45c1553735e14e577fe8866a89603a17
Opcode Fuzzy Hash: 0a758a3ecb8424518bc5823fdcc31f42a7c970e8bf4c98195f78cc6d516cd704
Instruction Fuzzy Hash: D5416B71900206EBDF14AF54DC85B6EB7B9FF04300F1440A9ED04AA2A7DB70DE65DBA0

Function 00C481DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00C0F3AB,00000000,?,?,00000000,?,00C0682C,00000004,00000000,00000000), ref: 00C4824C
EnableWindow.USER32(?,00000000), ref: 00C48272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00C482D1
ShowWindow.USER32(?,00000004), ref: 00C482E5
EnableWindow.USER32(?,00000001), ref: 00C4830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00C4832F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 67c92c3505e4858c0a35c9dd85968e3695810c07c97c303b4a13053c3e2f83eb
Instruction ID: 40e60f7431494ccf4dc3f7a1405149e76928fb5dbd683deb992b78ca5e45f0d4
Opcode Fuzzy Hash: 67c92c3505e4858c0a35c9dd85968e3695810c07c97c303b4a13053c3e2f83eb
Instruction Fuzzy Hash: 8641A334601644EFDF21CF15C899BEC7BE0FB0A714F1852A9E9284B2B2CB71AD49CB54

Function 00C14C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00C14C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00C14CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00C14CEA
_wcslen.LIBCMT ref: 00C14D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00C14D10
_wcsstr.LIBVCRUNTIME ref: 00C14D1A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 5eb82d8359b847b4998c4ca4877e1c819f0cb90d6871eb37b2c7be20075373d4
Instruction ID: 471ec23b432f162bbcddf9e549dfaf971211aaa7453dea457138ff52607e2caf
Opcode Fuzzy Hash: 5eb82d8359b847b4998c4ca4877e1c819f0cb90d6871eb37b2c7be20075373d4
Instruction Fuzzy Hash: FC21F975205201BBEB196B39EC49FBF7BDDDF46750F10806DF805CA1A2EA61DD40A6A0

Function 00C2581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BB3A97,?,?,00BB2E7F,?,?,?,00000000), ref: 00BB3AC2

_wcslen.LIBCMT ref: 00C2587B
CoInitialize.OLE32(00000000), ref: 00C25995
CoCreateInstance.OLE32(00C4FCF8,00000000,00000001,00C4FB68,?), ref: 00C259AE
CoUninitialize.OLE32 ref: 00C259CC

Strings

.lnk, xrefs: 00C25876, 00C258C1, 00C25985

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 3ee924e4c21a5e5b5e74607b5cae3183356daca1a59780d7781562795b22e212
Instruction ID: aab8e7220295cc46bccec101afe67f052fcf9c30627a0bdd12bd13cef96a5537
Opcode Fuzzy Hash: 3ee924e4c21a5e5b5e74607b5cae3183356daca1a59780d7781562795b22e212
Instruction Fuzzy Hash: 68D161746086109FC714EF24D484A6BBBE1FF89710F14889DF89A9B361DB31ED46CB92

Function 00C1175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C10FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C10FCA
Part of subcall function 00C10FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C10FD6
Part of subcall function 00C10FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C10FE5
Part of subcall function 00C10FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C10FEC
Part of subcall function 00C10FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C11002

GetLengthSid.ADVAPI32(?,00000000,00C11335), ref: 00C117AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00C117BA
HeapAlloc.KERNEL32(00000000), ref: 00C117C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00C117DA
GetProcessHeap.KERNEL32(00000000,00000000,00C11335), ref: 00C117EE
HeapFree.KERNEL32(00000000), ref: 00C117F5

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: b02ab9481e9e547fdf1a7269d6f3a85bf06fdae4abc80da99687559786f6ac45
Instruction ID: ac9d1c58861dcd06beb1db92563c06604a3eb6f23bfd9ff8e470ea6e36d766b3
Opcode Fuzzy Hash: b02ab9481e9e547fdf1a7269d6f3a85bf06fdae4abc80da99687559786f6ac45
Instruction Fuzzy Hash: FA11BE35902205FFDB109FA4CC89BEE7BA9FB43355F184018F95197260C739AA80EBA0

Function 00C114CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00C114FF
OpenProcessToken.ADVAPI32(00000000), ref: 00C11506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00C11515
CloseHandle.KERNEL32(00000004), ref: 00C11520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C1154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00C11563

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 177fbacfc791e9b29ccaf1c8a70245b878761a39d8028ee5e1864ecb9c9bba76
Instruction ID: 41f4cd1166f1ad0acf3b66cb7639e3d7ef955c9b153f0155dde94d7d0e4fe7ec
Opcode Fuzzy Hash: 177fbacfc791e9b29ccaf1c8a70245b878761a39d8028ee5e1864ecb9c9bba76
Instruction Fuzzy Hash: AB115C76601209EBDF118F94DD49BDE7BA9FF4A714F084014FE15A2060C3798E60EB60

Function 00BD3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BD3379,00BD2FE5), ref: 00BD3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BD339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BD33B7
SetLastError.KERNEL32(00000000,?,00BD3379,00BD2FE5), ref: 00BD3409

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5c96db53a4786165188b79bd6723985be3e9a7b7d619cf03748ef17325439075
Instruction ID: f3d1db033e507e886094902fb51dd89ad4023eb42373e7076794c17308b19774
Opcode Fuzzy Hash: 5c96db53a4786165188b79bd6723985be3e9a7b7d619cf03748ef17325439075
Instruction Fuzzy Hash: 1001F13260D312AEAB242BB46CC576AAAD4EB05B7932042AFF410803F2FF118D01958A

Function 00BE2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BE5686,00BF3CD6,?,00000000,?,00BE5B6A,?,?,?,?,?,00BDE6D1,?,00C78A48), ref: 00BE2D78
_free.LIBCMT ref: 00BE2DAB
_free.LIBCMT ref: 00BE2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00BDE6D1,?,00C78A48,00000010,00BB4F4A,?,?,00000000,00BF3CD6), ref: 00BE2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00BDE6D1,?,00C78A48,00000010,00BB4F4A,?,?,00000000,00BF3CD6), ref: 00BE2DEC
_abort.LIBCMT ref: 00BE2DF2

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: bf72a5dbdd783a08404e12fc89144616eb4cccf7c649d2f99d11ef4e28ddb40f
Instruction ID: e22d1264264773f7168906c3e0731ddd462b56852632a621e466643d200021ac
Opcode Fuzzy Hash: bf72a5dbdd783a08404e12fc89144616eb4cccf7c649d2f99d11ef4e28ddb40f
Instruction Fuzzy Hash: 61F0A93590558127C25227376C4AB5E17DDEFC27A5F3585B9FA25D22B2EF2488414160

Function 00C48A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00BC9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BC9693
Part of subcall function 00BC9639: SelectObject.GDI32(?,00000000), ref: 00BC96A2
Part of subcall function 00BC9639: BeginPath.GDI32(?), ref: 00BC96B9
Part of subcall function 00BC9639: SelectObject.GDI32(?,00000000), ref: 00BC96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00C48A4E
LineTo.GDI32(?,00000003,00000000), ref: 00C48A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00C48A70
LineTo.GDI32(?,00000000,00000003), ref: 00C48A80
EndPath.GDI32(?), ref: 00C48A90
StrokePath.GDI32(?), ref: 00C48AA0

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 758099572a75cbafcb145cf816801d9e8200054b6e549ee00fde75cdef4d18ae
Instruction ID: eaaa93c8d435346ab8a8aed9b9f48507411e4dfb4f9a61187441851f750df579
Opcode Fuzzy Hash: 758099572a75cbafcb145cf816801d9e8200054b6e549ee00fde75cdef4d18ae
Instruction Fuzzy Hash: 5A11F376001108FFEB129F90DC88FAE7FACFB09350F048022BA199A1B1C7719E55DBA0

Function 00C151FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C15218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00C15229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C15230
ReleaseDC.USER32(00000000,00000000), ref: 00C15238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00C1524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00C15261

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: e9d03b334cf6c9b85f135c6e063cd60e5f42052abf82b9aa49d5a255453667bf
Instruction ID: 9e60d29d41a2783cadf063ef8a939c0abb392ac1ffe6d245011f01a7afda9ad0
Opcode Fuzzy Hash: e9d03b334cf6c9b85f135c6e063cd60e5f42052abf82b9aa49d5a255453667bf
Instruction Fuzzy Hash: A9018F75A01708BBEB109BE59C89B8EBFB8FB49351F044065FA04A7291D6709901CBA0

Function 00BB1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BB1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00BB1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BB1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BB1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00BB1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BB1C22

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: ad0836e0f6c6897b50b3e5d435299eea8dc23ff755ba4a34934fdc1007d60142
Instruction ID: 81b60477b24c562aae8da97ca80123a0f671a05fcda219f92ba2dc3b7c53e4f7
Opcode Fuzzy Hash: ad0836e0f6c6897b50b3e5d435299eea8dc23ff755ba4a34934fdc1007d60142
Instruction Fuzzy Hash: E60167B0902B5ABDE3008F6A8C85B56FFA8FF19354F00411BA15C4BA42C7F5A864CFE5

Function 00C1EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00C1EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00C1EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00C1EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C1EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C1EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C1EB75

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: f2445ff1d90395bb641b4bf57dea7547f7ea51f7dcbcf5ca7af029a96083b7b0
Instruction ID: 0a2b455b670bd6bc62cf9860edc878534c51c7f6c82ff78e4d2ff4ad9385e00a
Opcode Fuzzy Hash: f2445ff1d90395bb641b4bf57dea7547f7ea51f7dcbcf5ca7af029a96083b7b0
Instruction Fuzzy Hash: 8FF03A7A642158BBE7615B629C4EFEF3A7CFFCBB11F004158FA11E10A1D7A05A01C6B5

Function 00C07439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00C07452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00C07469
GetWindowDC.USER32(?), ref: 00C07475
GetPixel.GDI32(00000000,?,?), ref: 00C07484
ReleaseDC.USER32(?,00000000), ref: 00C07496
GetSysColor.USER32(00000005), ref: 00C074B0

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: eedbdde88d89bf9151c9ef3ad986aeb08cfd2321df7ca642c8213dbfc2d4bc75
Instruction ID: 3b76ede428de45978d60ac66408c8917005df4e7e687f039b596ced660a249fe
Opcode Fuzzy Hash: eedbdde88d89bf9151c9ef3ad986aeb08cfd2321df7ca642c8213dbfc2d4bc75
Instruction Fuzzy Hash: BB018635801205EFEB905FA4DC48BEE7BB5FB05321F214164F926A20B1CB312E41EF10

Function 00C11874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00C1187F
UnloadUserProfile.USERENV(?,?), ref: 00C1188B
CloseHandle.KERNEL32(?), ref: 00C11894
CloseHandle.KERNEL32(?), ref: 00C1189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00C118A5
HeapFree.KERNEL32(00000000), ref: 00C118AC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 7a015997882e2be27e05dfa95010298a50a8ffd9ea31adcf466fa9f19e03c7a4
Instruction ID: a7b5c35642d5d3cad30dde7f2003a5404dfde3c61c44987ce0f8b6544df4132d
Opcode Fuzzy Hash: 7a015997882e2be27e05dfa95010298a50a8ffd9ea31adcf466fa9f19e03c7a4
Instruction Fuzzy Hash: 55E0E53A606101BBDB415FA1ED4CB4EBF39FF4AB22B108220F22581070CB329430DF50

Function 00C1C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB7620: _wcslen.LIBCMT ref: 00BB7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C1C6EE
_wcslen.LIBCMT ref: 00C1C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C1C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00C1C7CA

Strings

0, xrefs: 00C1C6AF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 34e7352773d8fe6bc71054a92f27fdfb698ea69d265035f2149c0dc933b8433a
Instruction ID: 9846d11ea68f6ffc563f2e0376c0096adc2df1f3163ddc4ddd91baf3b5addd76
Opcode Fuzzy Hash: 34e7352773d8fe6bc71054a92f27fdfb698ea69d265035f2149c0dc933b8433a
Instruction Fuzzy Hash: 6E51D0716843019BD7109F28C8C5BFF77E8AF46314F040A6DF9A5D21E0DBA0DA84EB96

Function 00C3AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00C3AEA3

Part of subcall function 00BB7620: _wcslen.LIBCMT ref: 00BB7625

GetProcessId.KERNEL32(00000000), ref: 00C3AF38
CloseHandle.KERNEL32(00000000), ref: 00C3AF67

Strings

@, xrefs: 00C3AE72
<, xrefs: 00C3AE6B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 37f59be9927d5422888377e6c5628fc08201cd7aad8601a990b2ff435762dc72
Instruction ID: 120a40723ba756ea993e425885e1cfde3107dd29ea278232f7e77e3b90a04a00
Opcode Fuzzy Hash: 37f59be9927d5422888377e6c5628fc08201cd7aad8601a990b2ff435762dc72
Instruction Fuzzy Hash: 62719C70A10615DFCB14DF94C495AAEBBF0FF08310F048499E856AB3A2CB74EE55CB91

Function 00C1719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00C17206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00C1723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00C1724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00C172CF

Strings

DllGetClassObject, xrefs: 00C17242

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 7c5b08c206c586122f33ff3fa9349eaaea9d665cc195102a8efff159eed19aa6
Instruction ID: eeebd60e9f2e8ab0e0a8aba4b9acfeab9aebd6099ddb9745fc385094b5718d6d
Opcode Fuzzy Hash: 7c5b08c206c586122f33ff3fa9349eaaea9d665cc195102a8efff159eed19aa6
Instruction Fuzzy Hash: A6415E71604204EFDB15CF54C884BDA7BB9EF4A310F1481A9BD05DF20AD7B1DA86EBA0

Function 00C43D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C43E35
IsMenu.USER32(?), ref: 00C43E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C43E92
DrawMenuBar.USER32 ref: 00C43EA5

Strings

0, xrefs: 00C43D89

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 3130aae306aefe4b749fe2072fef6027e5cd82e969971f2b0af1b3074e5c90e1
Instruction ID: 6689d8516968514108fca21b90fbb0585d57fdcf834310c3c149b97602f9b60c
Opcode Fuzzy Hash: 3130aae306aefe4b749fe2072fef6027e5cd82e969971f2b0af1b3074e5c90e1
Instruction Fuzzy Hash: 79414875A02249AFDB10DF50D884AAEBBB9FF89360F044169ED25A7250D730AE45DF60

Function 00C11DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00C13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C13CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00C11E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00C11E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00C11EA9

Part of subcall function 00BB6B57: _wcslen.LIBCMT ref: 00BB6B6A

Strings

ListBox, xrefs: 00C11E25
ComboBox, xrefs: 00C11DF0

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 76958849d061de717118e488991a487d545b1ab296439dae8503c67181c6d547
Instruction ID: a0337b2ea9a1f07c61a7e90caa3578f7ccaae17a6bff37fb3440f56f9d0e2c26
Opcode Fuzzy Hash: 76958849d061de717118e488991a487d545b1ab296439dae8503c67181c6d547
Instruction Fuzzy Hash: 46214971A00104BFDB14ABA0CC8ADFFB7B8EF42350B148169FD25A31E1DB784E45A620

Function 00C3C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C3C9F1
_wcslen.LIBCMT ref: 00C3CA68
_wcslen.LIBCMT ref: 00C3CA9E
_wcslen.LIBCMT ref: 00C3CAF9
_wcslen.LIBCMT ref: 00C3CB2F
_wcslen.LIBCMT ref: 00C3CB7F

Strings

HKLM, xrefs: 00C3CA98, 00C3CA9D
HKEY_LOCAL_MACHINE, xrefs: 00C3CA62, 00C3CA67

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: a317fcdc72677ba7c2e510f99805f561e6776928615cda0ede5152a803813a48
Instruction ID: 8cdfa4e580885ca34a21166a6797a852e332351b000815a1c7416a57dbd8c28b
Opcode Fuzzy Hash: a317fcdc72677ba7c2e510f99805f561e6776928615cda0ede5152a803813a48
Instruction Fuzzy Hash: 9E31F273A2016A4BCB20EF2DC8D01BE33D19BA1790F154029E865BB348EA71CF40A3A0

Function 00C42F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00C42F8D
LoadLibraryW.KERNEL32(?), ref: 00C42F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00C42FA9
DestroyWindow.USER32(?), ref: 00C42FB1

Strings

SysAnimate32, xrefs: 00C42F68

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 4db712dac5ac46ff1687e40958cd7359deb96b61162f5b3286a8a8fa6d037373
Instruction ID: f9c5ffd8dda4629f3e23f4aa36e8a782e820c80ccf526dead3a3add58564ac03
Opcode Fuzzy Hash: 4db712dac5ac46ff1687e40958cd7359deb96b61162f5b3286a8a8fa6d037373
Instruction Fuzzy Hash: 71219A71200229ABFB104FA4DC82FBB3BBDFB59364F904228F960D21A0D771DC959760

Function 00BD4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00BD4D1E,00BE28E9,?,00BD4CBE,00BE28E9,00C788B8,0000000C,00BD4E15,00BE28E9,00000002), ref: 00BD4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BD4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00BD4D1E,00BE28E9,?,00BD4CBE,00BE28E9,00C788B8,0000000C,00BD4E15,00BE28E9,00000002,00000000), ref: 00BD4DC3

Strings

CorExitProcess, xrefs: 00BD4D98
mscoree.dll, xrefs: 00BD4D86

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b2cab51f9a9fb8cbab5ab7cd7760de5444c71cb78f6e96977d9630c733ac712d
Instruction ID: 56309ab1c82c3ad1e61e1917406636ac5699883b396df4deb3487cd33456f854
Opcode Fuzzy Hash: b2cab51f9a9fb8cbab5ab7cd7760de5444c71cb78f6e96977d9630c733ac712d
Instruction Fuzzy Hash: 40F04F39A41208BBDB519F90DC89BAEBFF5EF48752F0000A9F809A2260DB715D80CA94

Function 00C0D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00C0D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00C0D3BF
FreeLibrary.KERNEL32(00000000), ref: 00C0D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00C0D3B9
X64, xrefs: 00C0D2A8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 543b9dd29ca7442c2bf2935bbb7f592edba3138d8c57b781b934bb81b5e363e8
Instruction ID: bf2e550ad6755cf68273bc07e25e5c05820583dfe2c1507fef5e2b5c2354c384
Opcode Fuzzy Hash: 543b9dd29ca7442c2bf2935bbb7f592edba3138d8c57b781b934bb81b5e363e8
Instruction Fuzzy Hash: A9F0E57A806A21EBD7B167518C98B6DB774BF11B01F5581A9F817E20B4DB20CE44CB86

Function 00BB4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00BB4EDD,?,00C81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BB4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00BB4EAE
FreeLibrary.KERNEL32(00000000,?,?,00BB4EDD,?,00C81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BB4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00BB4EA8
kernel32.dll, xrefs: 00BB4E94

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: ccd8c1354e3a7455d1e9ce4ec41c8c26cbde28593d6cf621c1fc12b7870c5ccf
Instruction ID: 7f6ad32f26a2db6c296ade3e561a2ad005860c0693073eefd6088874455c7d5c
Opcode Fuzzy Hash: ccd8c1354e3a7455d1e9ce4ec41c8c26cbde28593d6cf621c1fc12b7870c5ccf
Instruction Fuzzy Hash: 7EE0CD3AA035225BD27117296C58BBF6594FF82F627050165FC04D2122DBE0CD0185A1

Function 00BB4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00BF3CDE,?,00C81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BB4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00BB4E74
FreeLibrary.KERNEL32(00000000,?,?,00BF3CDE,?,00C81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BB4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00BB4E6E
kernel32.dll, xrefs: 00BB4E5B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: ddf22df2ee8e06db9afce101920e682fb4bea986d09e662c9ea71f9f31f30f8f
Instruction ID: 898e7672a6b94149fdccd51922d24b4501f6778334dcce6a1be80e4cdf5c8f37
Opcode Fuzzy Hash: ddf22df2ee8e06db9afce101920e682fb4bea986d09e662c9ea71f9f31f30f8f
Instruction Fuzzy Hash: F4D0C23A503A215746621B246C08FDF2B58FF82B113050160B804A2121CFA0CD02C5E0

Function 00C22947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C22C05
DeleteFileW.KERNEL32(?), ref: 00C22C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00C22C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C22CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C22CC0

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: db36a97ab34a4038831578e8bed3f59f5758ea4141d0c166111d559e84add4a1
Instruction ID: 4e185cd12a2cfc46259196b4b322721650f758f4c27a1db2ac06e6437a7b63b6
Opcode Fuzzy Hash: db36a97ab34a4038831578e8bed3f59f5758ea4141d0c166111d559e84add4a1
Instruction Fuzzy Hash: EEB16E72E00129ABDF21EFA4DC85EEEB7BDEF09350F1040A6F509E6151EA709A448F61

Function 00C3A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00C3A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00C3A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00C3A468
CloseHandle.KERNEL32(?), ref: 00C3A63D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 1518d653dfc1f6745b5acdc1c59553c3a52f9d87f57433e3e47483b884cc7d37
Instruction ID: 7e6d032ca6c710207be86cce3c37506042d461eba041767e712071d0ac7bb7b7
Opcode Fuzzy Hash: 1518d653dfc1f6745b5acdc1c59553c3a52f9d87f57433e3e47483b884cc7d37
Instruction Fuzzy Hash: 02A190716147009FD720DF24C886F2AB7E5AF84714F14889DF5AA9B392DBB0ED41CB92

Function 00C1E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C1CF22,?), ref: 00C1DDFD

Part of subcall function 00C1DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C1CF22,?), ref: 00C1DE16

Part of subcall function 00C1E199: GetFileAttributesW.KERNEL32(?,00C1CF95), ref: 00C1E19A

lstrcmpiW.KERNEL32(?,?), ref: 00C1E473
MoveFileW.KERNEL32(?,?), ref: 00C1E4AC
_wcslen.LIBCMT ref: 00C1E5EB
_wcslen.LIBCMT ref: 00C1E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00C1E650

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: f9b50575625b2256415a5d1d7f49bacb882cfe4278022666bf54832ed1cd1ef9
Instruction ID: 072228316284d73a343975e6ef9345e46b2201140275d5a7f20d64840eb88fef
Opcode Fuzzy Hash: f9b50575625b2256415a5d1d7f49bacb882cfe4278022666bf54832ed1cd1ef9
Instruction Fuzzy Hash: BB5172B24083459BC724EB90DC819DFB3ECAF85340F10491EFA99D3191EF74A6C89766

Function 00C3B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00C3C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C3B6AE,?,?), ref: 00C3C9B5
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3C9F1
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3CA68
Part of subcall function 00C3C998: _wcslen.LIBCMT ref: 00C3CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C3BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C3BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00C3BB63
RegCloseKey.ADVAPI32(?,?), ref: 00C3BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00C3BBB3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: adb506376acc144d6c744382a0954552917174a89b8ba9f92b411567ea8fdd42
Instruction ID: bd4e3fbeaba801c94869ee186d1a6f358a6b05a30935f99fa2fa8682e68faefd
Opcode Fuzzy Hash: adb506376acc144d6c744382a0954552917174a89b8ba9f92b411567ea8fdd42
Instruction Fuzzy Hash: 9761A031218241AFD314DF14C8D1E6ABBE5FF84308F14859DF59A8B2A2DB31ED45DB92

Function 00C18BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C18BCD
VariantClear.OLEAUT32 ref: 00C18C3E
VariantClear.OLEAUT32 ref: 00C18C9D
VariantClear.OLEAUT32(?), ref: 00C18D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00C18D3B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: e59bf211b3da27f7e66501f180bbdb9046c18bcb83f033ae086e2027956a8c97
Instruction ID: 47bfb1b0a5641b8bae085cc33b3379fd0f1c5a8a848dd69e30d459251cc9bb6d
Opcode Fuzzy Hash: e59bf211b3da27f7e66501f180bbdb9046c18bcb83f033ae086e2027956a8c97
Instruction Fuzzy Hash: 635169B5A0021AEFCB10DF68D894AAAB7F8FF8A310B158559F915DB350E730E951CF90

Function 00C28AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00C28BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00C28BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00C28C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00C28C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00C28C5F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 841cae93c771716cc7f8eb92ed345d781166f835a7ac17e2807fa25313fe97cc
Instruction ID: df2db722d2d262da5713098a544d2988891681905175e8441f7d9459cabb2a88
Opcode Fuzzy Hash: 841cae93c771716cc7f8eb92ed345d781166f835a7ac17e2807fa25313fe97cc
Instruction Fuzzy Hash: FA516B35A002159FCB11DF64C881EADBBF5FF49314F088098E849AB362CB71ED45CBA0

Function 00C38EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00C38F40
GetProcAddress.KERNEL32(00000000,?), ref: 00C38FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00C38FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00C39032
FreeLibrary.KERNEL32(00000000), ref: 00C39052

Part of subcall function 00BCF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00C21043,?,753CE610), ref: 00BCF6E6
Part of subcall function 00BCF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00C0FA64,00000000,00000000,?,?,00C21043,?,753CE610,?,00C0FA64), ref: 00BCF70D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 143ec90e8d4d364eaff7cd4e35ba9b76d58472f5e6b0ba318515786ace15fdc9
Instruction ID: 82f8e84dcfe66a9ddd03660dcb609cfbf49d202f6e2340436bf1ccb9cca9bb20
Opcode Fuzzy Hash: 143ec90e8d4d364eaff7cd4e35ba9b76d58472f5e6b0ba318515786ace15fdc9
Instruction Fuzzy Hash: 1F514835615205DFCB14DF68C4949ADBBF1FF49314F0480A8E81A9B362DB71EE85CB90

Function 00C46B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00C46C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00C46C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00C46C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00C2AB79,00000000,00000000), ref: 00C46C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00C46CC7

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 277b2a3ed0441b5adea94ebd05b3273d402cde0ce84784011c2d0e7a8920d98f
Instruction ID: 94fa45b8b0d7618e654f7a4dfcf92baf7866b193039aa11bcbddbc42a12e00a6
Opcode Fuzzy Hash: 277b2a3ed0441b5adea94ebd05b3273d402cde0ce84784011c2d0e7a8920d98f
Instruction Fuzzy Hash: 0E41B235A04104AFDB24CF69CCD8FA97BA5FB0B360F150268FCA5A72E4C771AE41DA51

Function 00BE2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BE20C3
_free.LIBCMT ref: 00BE20E3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3b43a442a61eda07880525ee95aaa4eb1b480a0d3ca65ed4f39912933f15101d
Instruction ID: 0dfeda684c52cb24c49d6a4744b127c1a890d48f512158c37d11036d3bbc5e46
Opcode Fuzzy Hash: 3b43a442a61eda07880525ee95aaa4eb1b480a0d3ca65ed4f39912933f15101d
Instruction Fuzzy Hash: 9E41D332A002449FDB24DF79C881A5DB7F9EF89314F1545E9E516EB392D731AE01CB81

Function 00BC912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BC9141
ScreenToClient.USER32(00000000,?), ref: 00BC915E
GetAsyncKeyState.USER32(00000001), ref: 00BC9183
GetAsyncKeyState.USER32(00000002), ref: 00BC919D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: e1c8af059dc767bb0df118c79b9b479645b626d6fd166fa39523f2f198c8c160
Instruction ID: 0b8427d331f61917756cf31fa209e5759786bd8eaf50d68f1cd5df61ddff2f86
Opcode Fuzzy Hash: e1c8af059dc767bb0df118c79b9b479645b626d6fd166fa39523f2f198c8c160
Instruction Fuzzy Hash: 02416231A0851AFBDF199F64C889BEEB7B4FB05320F244359E429A32E0C7346950DB91

Function 00C23874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00C238CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00C23922
TranslateMessage.USER32(?), ref: 00C2394B
DispatchMessageW.USER32(?), ref: 00C23955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C23966

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 4c9ab98c9103b20adaee5513a7b229288c352e64b90de2745269e976020ff872
Instruction ID: b56172e1759c1459367039b8377e6186698e5e9b216868d0be98ba5faed780e6
Opcode Fuzzy Hash: 4c9ab98c9103b20adaee5513a7b229288c352e64b90de2745269e976020ff872
Instruction Fuzzy Hash: B331C8705043D19EEB25DB35A849BBA37E8AB06314F08056DE872C69E0D3B89BC5DB15

Function 00C2CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00C2CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00C2CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00C2C21E,00000000), ref: 00C2CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00C2C21E,00000000), ref: 00C2CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00C2C21E,00000000), ref: 00C2CFF2

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 470080b27c827250684edb10d55004b3a83c8fed0e1563d9d4a6eb40f18cdbfd
Instruction ID: da799fdc397e7ba9c304382b74243e4b60f6b7e8cd5be3788c666e600bb6d390
Opcode Fuzzy Hash: 470080b27c827250684edb10d55004b3a83c8fed0e1563d9d4a6eb40f18cdbfd
Instruction Fuzzy Hash: 21314C71500615EFDB20DFE5E9C4AAFBBF9FB15350B10446EF526D2550DB30AE409B60

Function 00C11901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C11915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00C119C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00C119C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00C119DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00C119E2

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 7c3d37044747e121fe4bb441dddd890d2b57426b760aebb463c29f9b199d27d3
Instruction ID: 19bfe03ff7132998264c233a4fc2c6380621288228e2b454861321dedde86b7a
Opcode Fuzzy Hash: 7c3d37044747e121fe4bb441dddd890d2b57426b760aebb463c29f9b199d27d3
Instruction Fuzzy Hash: FC319E75900219EFCB00CFA8C999BDE3BB5EB06315F148225FE31A72D1C7749A94DB90

Function 00C45706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00C45745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00C4579D
_wcslen.LIBCMT ref: 00C457AF
_wcslen.LIBCMT ref: 00C457BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C45816

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: bca17691b914d964afd480744917658dcfb351566e3fd44a479bbd50bf27d4e1
Instruction ID: b317178427f3f11d71ce341f984e61578bc7ed076dfc031f2f4120502f022f91
Opcode Fuzzy Hash: bca17691b914d964afd480744917658dcfb351566e3fd44a479bbd50bf27d4e1
Instruction Fuzzy Hash: 5B21B675904618DBDB209F61CC85AEDB7B8FF15324F108266F929EB1C1D7708A85CF50

Function 00C30930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00C30951
GetForegroundWindow.USER32 ref: 00C30968
GetDC.USER32(00000000), ref: 00C309A4
GetPixel.GDI32(00000000,?,00000003), ref: 00C309B0
ReleaseDC.USER32(00000000,00000003), ref: 00C309E8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 5a49fe0ea99cff5dbbbad3aa69515460c93404e713d6ae91185915f32e683e6d
Instruction ID: 5e7a2267303650296533b0117c240645e4d66011189d1deaa64e6ae082b7442d
Opcode Fuzzy Hash: 5a49fe0ea99cff5dbbbad3aa69515460c93404e713d6ae91185915f32e683e6d
Instruction Fuzzy Hash: DC219F3A600214AFD714EF65D898BAEBBE9FF45710F148068F84A97762CB70AD04CB50

Function 00BECDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00BECDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BECDE9

Part of subcall function 00BE3820: RtlAllocateHeap.NTDLL(00000000,?,00C81444,?,00BCFDF5,?,?,00BBA976,00000010,00C81440,00BB13FC,?,00BB13C6,?,00BB1129), ref: 00BE3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00BECE0F
_free.LIBCMT ref: 00BECE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BECE31

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: c54a5586564d86d57004592e42b03388baff5a7b7b5f7a520f4c9333bfc8eb38
Instruction ID: 1ef69bf7a2f434a0a04d6cee33df0833d1f3e3b851f1ffb72a381c7fc196f7a7
Opcode Fuzzy Hash: c54a5586564d86d57004592e42b03388baff5a7b7b5f7a520f4c9333bfc8eb38
Instruction Fuzzy Hash: B501D4766022957F23211ABB6CCCE7F6DEDEEC7BA131501A9FD05D7211EB619D0281B0

Function 00BC9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BC9693
SelectObject.GDI32(?,00000000), ref: 00BC96A2
BeginPath.GDI32(?), ref: 00BC96B9
SelectObject.GDI32(?,00000000), ref: 00BC96E2

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: ec620fc9abdba244d1ca1c7bf9c14316e586ff4a4e7931e4e730fc97351ae1b2
Instruction ID: b2fe6768cccc035fdb4153cd3b5151dd2ff53ae689a030326bfdaf8f31399ff1
Opcode Fuzzy Hash: ec620fc9abdba244d1ca1c7bf9c14316e586ff4a4e7931e4e730fc97351ae1b2
Instruction Fuzzy Hash: 0A215030802305EBEB119F64EC58BAD7BFCFB51755F14426AF810A61F0D3709992CB98

Function 00C15711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00C15726
_memcmp.LIBVCRUNTIME ref: 00C15744
_memcmp.LIBVCRUNTIME ref: 00C15757
_memcmp.LIBVCRUNTIME ref: 00C1576F
_memcmp.LIBVCRUNTIME ref: 00C15787

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 98012af643da1d539f2c69ecd03b2df4a637c7b9dd88a734eafc57f5e955399e
Instruction ID: 8678b33475ed51ea41242cf0b7806a7ed779fcec69aabad888f8ec7be53b55c3
Opcode Fuzzy Hash: 98012af643da1d539f2c69ecd03b2df4a637c7b9dd88a734eafc57f5e955399e
Instruction Fuzzy Hash: CF01F5A5651609FBE21855159D83FFBB38CEBA23A4F004035FD049A2C2F720EE9192E4

Function 00BE2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00BDF2DE,00BE3863,00C81444,?,00BCFDF5,?,?,00BBA976,00000010,00C81440,00BB13FC,?,00BB13C6), ref: 00BE2DFD
_free.LIBCMT ref: 00BE2E32
_free.LIBCMT ref: 00BE2E59
SetLastError.KERNEL32(00000000,00BB1129), ref: 00BE2E66
SetLastError.KERNEL32(00000000,00BB1129), ref: 00BE2E6F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: b61e0b989f4cf824cd7d9bedd7f309a4e4ed12932aafc7c4be648bda85034c42
Instruction ID: a9cf5618e66276590d3d7cf8c72ce2674e4083bde5be09093af2adf693d1175d
Opcode Fuzzy Hash: b61e0b989f4cf824cd7d9bedd7f309a4e4ed12932aafc7c4be648bda85034c42
Instruction Fuzzy Hash: F701F43660669067C6122B776CCAF6F26DDEBC27A5B3141B8F425A32A3EB248C014120

Function 00C1000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C0FF41,80070057,?,?,?,00C1035E), ref: 00C1002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C0FF41,80070057,?,?), ref: 00C10046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C0FF41,80070057,?,?), ref: 00C10054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C0FF41,80070057,?), ref: 00C10064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C0FF41,80070057,?,?), ref: 00C10070

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: e39de49507b3a85d2f0a187eba51ce4f12a3c697a79d86fdb63d34d2cf60f938
Instruction ID: b270c64450c6f55f5806ba2a27d8bb5a65ff15d48b26794c628ac658263e9713
Opcode Fuzzy Hash: e39de49507b3a85d2f0a187eba51ce4f12a3c697a79d86fdb63d34d2cf60f938
Instruction Fuzzy Hash: 51018476601204BFDB504F65DC44BEE7BADEB49752F244114F905D2220E7B5DEC09760

Function 00C110F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C11114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00C10B9B,?,?,?), ref: 00C11120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00C10B9B,?,?,?), ref: 00C1112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00C10B9B,?,?,?), ref: 00C11136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C1114D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: eadc1598150e1a218485b2ea1b919a8ca0f3caf64a4f0900de093c5a653ffe83
Instruction ID: ea80d1f53ad96b5193aacc11d932619131266916e00cc55d149911de01c22980
Opcode Fuzzy Hash: eadc1598150e1a218485b2ea1b919a8ca0f3caf64a4f0900de093c5a653ffe83
Instruction Fuzzy Hash: 6D016979602205BFDB514FA5DC89BAE3B6EFF8B3A4B240418FA41C3360DA31DD409A60

Function 00C10FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C10FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C10FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C10FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C10FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C11002

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a4368d8ae7dfe92f75c9d1d63e1123bc39e51144da90ca4a3d28fbc055679aa0
Instruction ID: 48e3a6b0cb853418f4e632dea90f3e1f791def507a9784503e0890d8b5c24486
Opcode Fuzzy Hash: a4368d8ae7dfe92f75c9d1d63e1123bc39e51144da90ca4a3d28fbc055679aa0
Instruction Fuzzy Hash: 89F04939602301AFDB214FA49C89F9A3BADFF8A7A2F144414FA45C6261CA74DC908A60

Function 00C11014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C1102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C11036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C11045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00C1104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C11062

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ac14b4bfcf6fb1345d677ba403e2059fc2c9f2cdd82d98da9fd679091d7749b4
Instruction ID: baced1b4745af1af8b3ce68efd8872c2b00226320457ca378a9aa262edc6fccf
Opcode Fuzzy Hash: ac14b4bfcf6fb1345d677ba403e2059fc2c9f2cdd82d98da9fd679091d7749b4
Instruction Fuzzy Hash: 14F06D39602301EBDB215FA5EC89F9A3BADFF8B761F140414FE45C7260CA74D991CA60

Function 00C2030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00C2017D,?,00C232FC,?,00000001,00BF2592,?), ref: 00C20324
CloseHandle.KERNEL32(?,?,?,?,00C2017D,?,00C232FC,?,00000001,00BF2592,?), ref: 00C20331
CloseHandle.KERNEL32(?,?,?,?,00C2017D,?,00C232FC,?,00000001,00BF2592,?), ref: 00C2033E
CloseHandle.KERNEL32(?,?,?,?,00C2017D,?,00C232FC,?,00000001,00BF2592,?), ref: 00C2034B
CloseHandle.KERNEL32(?,?,?,?,00C2017D,?,00C232FC,?,00000001,00BF2592,?), ref: 00C20358
CloseHandle.KERNEL32(?,?,?,?,00C2017D,?,00C232FC,?,00000001,00BF2592,?), ref: 00C20365

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f6dc0ad8f1148967a329948b02f2b5ea9bb7244805e1be4c18c41fd962d20eb3
Instruction ID: dcf0580ffd1d813f91f686de102f8775da93a0c8a9c54b21d3fef49f6eaa42d2
Opcode Fuzzy Hash: f6dc0ad8f1148967a329948b02f2b5ea9bb7244805e1be4c18c41fd962d20eb3
Instruction Fuzzy Hash: 1401A272801B259FC7309F66E880416FBF5BF503153258A3FD1A652932C3B1AA54CF80

Function 00BED73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BED752

Part of subcall function 00BE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000), ref: 00BE29DE
Part of subcall function 00BE29C8: GetLastError.KERNEL32(00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000,00000000), ref: 00BE29F0

_free.LIBCMT ref: 00BED764
_free.LIBCMT ref: 00BED776
_free.LIBCMT ref: 00BED788
_free.LIBCMT ref: 00BED79A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3edd93d844d922d7e39f876977f73d274d6a7194c4cbdd70c12051c62cf3c1fa
Instruction ID: c526c60e561e9cd7cce40fd8898032fe2277cb786323a328542a81ee6c4a0eeb
Opcode Fuzzy Hash: 3edd93d844d922d7e39f876977f73d274d6a7194c4cbdd70c12051c62cf3c1fa
Instruction Fuzzy Hash: 41F06232500289ABC721EB66F9C2E1A77DDFB04310B951899F058E7642CB78FC808660

Function 00C15C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00C15C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00C15C6F
MessageBeep.USER32(00000000), ref: 00C15C87
KillTimer.USER32(?,0000040A), ref: 00C15CA3
EndDialog.USER32(?,00000001), ref: 00C15CBD

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: c26ca153f8931fead4bd2eda6087fa55a17dd1d4305bc3f60e3a20212c4a43ca
Instruction ID: cc6d89243dd7f55f092c19568b8e63f9fb4494b9dad870dd323606ee8feb9865
Opcode Fuzzy Hash: c26ca153f8931fead4bd2eda6087fa55a17dd1d4305bc3f60e3a20212c4a43ca
Instruction Fuzzy Hash: 93018134501B04EBEB205F10DD9EFEA77B8BB46B05F010559B693A10F1DBF4AA949A90

Function 00BE22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BE22BE

Part of subcall function 00BE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000), ref: 00BE29DE
Part of subcall function 00BE29C8: GetLastError.KERNEL32(00000000,?,00BED7D1,00000000,00000000,00000000,00000000,?,00BED7F8,00000000,00000007,00000000,?,00BEDBF5,00000000,00000000), ref: 00BE29F0

_free.LIBCMT ref: 00BE22D0
_free.LIBCMT ref: 00BE22E3
_free.LIBCMT ref: 00BE22F4
_free.LIBCMT ref: 00BE2305

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 98590cf3704eb205d03ea5d284818367780ebec6f94db8c0654f327a34b1a635
Instruction ID: ba6eaebb3d1c59de752baeb29db261f5856a4471801d7703264178a7658cd99e
Opcode Fuzzy Hash: 98590cf3704eb205d03ea5d284818367780ebec6f94db8c0654f327a34b1a635
Instruction Fuzzy Hash: 3AF054754001558B8722AF95BC42B0C3BECF718760B15555AF514DA3B2C73C04529FE9

Function 00BC95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00BC95D4
StrokeAndFillPath.GDI32(?,?,00C071F7,00000000,?,?,?), ref: 00BC95F0
SelectObject.GDI32(?,00000000), ref: 00BC9603
DeleteObject.GDI32 ref: 00BC9616
StrokePath.GDI32(?), ref: 00BC9631

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 2011e164de1fbd9e30d84c293d5cb84b709275d1b1320725a22863a176d6a4db
Instruction ID: 799ea648effcbd359d8b1f89c1c81316dea1931412a0f1c21c30f9ab43c38d51
Opcode Fuzzy Hash: 2011e164de1fbd9e30d84c293d5cb84b709275d1b1320725a22863a176d6a4db
Instruction Fuzzy Hash: 85F0EC35006704EBEB665F65ED5CB6C3BE9FB12322F088268F865550F0D7348996DF28

Function 00BE0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00BE10F9
__freea.LIBCMT ref: 00BE1117

Part of subcall function 00BE1537: _free.LIBCMT ref: 00BE154F

Strings

am/pm, xrefs: 00BE117A
a/p, xrefs: 00BE11DE

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: f5f79bb7c7d63f9d8d5d3bff949ec2c5f81a43927070c94842727f943229934d
Instruction ID: d390c44fd1d8141ab17eca1a7d858cdd6e0bd445f24d1c83e71eae9efcd8067e
Opcode Fuzzy Hash: f5f79bb7c7d63f9d8d5d3bff949ec2c5f81a43927070c94842727f943229934d
Instruction Fuzzy Hash: 99D1F371900286EACB249F6EC895BFEB7F0EF05700F344AD9E601AB651D3759D80CBA5

Function 00C37B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00BD0242: EnterCriticalSection.KERNEL32(00C8070C,00C81884,?,?,00BC198B,00C82518,?,?,?,00BB12F9,00000000), ref: 00BD024D
Part of subcall function 00BD0242: LeaveCriticalSection.KERNEL32(00C8070C,?,00BC198B,00C82518,?,?,?,00BB12F9,00000000), ref: 00BD028A

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00BD00A3: __onexit.LIBCMT ref: 00BD00A9

__Init_thread_footer.LIBCMT ref: 00C37BFB

Part of subcall function 00BD01F8: EnterCriticalSection.KERNEL32(00C8070C,?,?,00BC8747,00C82514), ref: 00BD0202
Part of subcall function 00BD01F8: LeaveCriticalSection.KERNEL32(00C8070C,?,00BC8747,00C82514), ref: 00BD0235

Strings

5, xrefs: 00C37C78
G, xrefs: 00C37C7F
Variable must be of type 'Object'., xrefs: 00C37C3A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 0f78efe740493ba3427b3d951f4621a68e483ef95fbc78fd01588af309d300b3
Instruction ID: 09ddc6c33a70f95a1d2dd2f221c3a3925950958ea60361ee421f6b53efdb447f
Opcode Fuzzy Hash: 0f78efe740493ba3427b3d951f4621a68e483ef95fbc78fd01588af309d300b3
Instruction Fuzzy Hash: E2919DB0A14209EFCB24EF54D895DBDB7B1FF45304F108199F816AB2A2DB71AE41DB50

Function 00C12716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C121D0,?,?,00000034,00000800,?,00000034), ref: 00C1B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00C12760

Part of subcall function 00C1B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C121FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00C1B3F8

Part of subcall function 00C1B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00C1B355
Part of subcall function 00C1B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00C12194,00000034,?,?,00001004,00000000,00000000), ref: 00C1B365
Part of subcall function 00C1B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00C12194,00000034,?,?,00001004,00000000,00000000), ref: 00C1B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C127CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C1281A

Strings

@, xrefs: 00C12832

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: ce3f4608d7be6370a95eb030e25300d34a62a8d4add262772035defcb69034f4
Instruction ID: f6fac14ffa117f28bb7b5c373f6dc45b9074b4fdd4ab9d25bd92c8632dc777ae
Opcode Fuzzy Hash: ce3f4608d7be6370a95eb030e25300d34a62a8d4add262772035defcb69034f4
Instruction Fuzzy Hash: 2C413D76900218AFDB10DFA4CD81BEEBBB8AF06300F008095FA55B7191DB706E85DBA0

Function 00BE172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00BE1769
_free.LIBCMT ref: 00BE1834
_free.LIBCMT ref: 00BE183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00BE1760, 00BE1767, 00BE1796, 00BE17CE

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: eeef2152cc5b48171a1f2bfeec132068e146ba1d6d0d9ba043c29b2ebaa85c12
Instruction ID: 1e1308cf0c8b874833d94fe63faded4dcec2515b4d83851142421bac6755aba1
Opcode Fuzzy Hash: eeef2152cc5b48171a1f2bfeec132068e146ba1d6d0d9ba043c29b2ebaa85c12
Instruction Fuzzy Hash: BF3180B5A00298ABDB21DB9A9C81E9EBBFCEB85710B2445E6F80597211D7708E41CB90

Function 00C1C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00C1C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00C1C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00C81990,01716590), ref: 00C1C395

Strings

0, xrefs: 00C1C2DF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: dcd30f539e58c814d883a4c5237954daac2c8dc7959b6bbe10e9e3aaeec2839b
Instruction ID: 5feeb9ff55c3a95e25821f753841d6d10314b044c1c2abb402e4b241e29c6a49
Opcode Fuzzy Hash: dcd30f539e58c814d883a4c5237954daac2c8dc7959b6bbe10e9e3aaeec2839b
Instruction Fuzzy Hash: E941C0312443019FD720DF25D8C4B9ABBE4AF86320F00865EF9B5972A1D730E944EB56

Function 00C44416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00C4CC08,00000000,?,?,?,?), ref: 00C444AA
GetWindowLongW.USER32 ref: 00C444C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C444D7

Strings

SysTreeView32, xrefs: 00C4447C

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: ee8c912ad724970d2ec960b469ce72e688a4f8a01d00d8818d0f4bbeaa764b29
Instruction ID: 8aacdb0ece486a9d3ccf9fea5d18d545aef37265e9ed75e5b7aae79b5435ea9e
Opcode Fuzzy Hash: ee8c912ad724970d2ec960b469ce72e688a4f8a01d00d8818d0f4bbeaa764b29
Instruction Fuzzy Hash: 1D316B32210605ABDF249E78DC85BEA7BA9FB09334F209725F979921E0D770AD509B50

Function 00C3304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C3335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00C33077,?,?), ref: 00C33378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C3307A
_wcslen.LIBCMT ref: 00C3309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00C33106

Strings

255.255.255.255, xrefs: 00C33095, 00C3309A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: b3c6f572a08794eaa15ebb4b3754e1556ba6c9943676aadfa5cc6685a340a3cb
Instruction ID: 4bb3ea1112c7d7c7a167caf65d9533b6121c433143e29fa9369e4d32913c4f7b
Opcode Fuzzy Hash: b3c6f572a08794eaa15ebb4b3754e1556ba6c9943676aadfa5cc6685a340a3cb
Instruction Fuzzy Hash: 3531D5396142819FCB14DF69C585EA977F0EF54318F248099E9258F3A2DB71DF41C760

Function 00C43EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00C43F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00C43F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C43F78

Strings

SysMonthCal32, xrefs: 00C43F0B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 9d44569b77686d4b757a4d367c1d0b7d60ebf3996c537e9884565b397879d440
Instruction ID: 163cc6a84fda0dd2fcd7576b1c4349fc060e364ba8d645ca413d6b144ebbc375
Opcode Fuzzy Hash: 9d44569b77686d4b757a4d367c1d0b7d60ebf3996c537e9884565b397879d440
Instruction Fuzzy Hash: CC219C32600219BBEF119E90CC86FEE3B79FB89724F110254FE15AB1D0D6B1A9549B90

Function 00C44653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00C44705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00C44713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00C4471A

Strings

msctls_updown32, xrefs: 00C44684

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: a1c04d590583386408a146246c96707b970601292ad980272370229a45a79dea
Instruction ID: ab1e8960f0aeba5c85cc638fa79862ed65e29c4c0543bba77e64974c01467806
Opcode Fuzzy Hash: a1c04d590583386408a146246c96707b970601292ad980272370229a45a79dea
Instruction Fuzzy Hash: C4214AB5600209AFDB14DF64DCC1EBA37EDFB5A3A4B150059FA149B361CB70ED12CA60

Function 00C195AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C1961D

Strings

#requireadmin, xrefs: 00C195D9
#notrayicon, xrefs: 00C195B7
#OnAutoItStartRegister, xrefs: 00C195F3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 69d595cef806fa1ea2da8cce97ec8662a4c659e728bb0af5c7287785afecd1df
Instruction ID: 695ea044d6d327bafd0c6df1a65e143508800cb5afa600b6ccab8b85a0611a34
Opcode Fuzzy Hash: 69d595cef806fa1ea2da8cce97ec8662a4c659e728bb0af5c7287785afecd1df
Instruction Fuzzy Hash: CD213B32104511A7D331AB259C22FF7B3D9EF93300F10407AF95997141EBB1AE82E2A5

Function 00C437B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00C43840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00C43850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00C43876

Strings

Listbox, xrefs: 00C4380F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 779cfbd94588a6e2a942b5c4ffc04a4bc525e5a97573a84dccd4c44ec7ae3db1
Instruction ID: 97a0e3fab7a41bb8b2c614bcecb1ad4094751290e37f4ede153531708d5f1dbd
Opcode Fuzzy Hash: 779cfbd94588a6e2a942b5c4ffc04a4bc525e5a97573a84dccd4c44ec7ae3db1
Instruction Fuzzy Hash: A221BE72600218BBEB218F55CC85FBB3B6EFFC9760F118125F9549B190C671DD5287A0

Function 00C249F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C24A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00C24A5C
SetErrorMode.KERNEL32(00000000,?,?,00C4CC08), ref: 00C24AD0

Strings

%lu, xrefs: 00C24A6F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: f79b629866164b0200903a3b8b11069d8512e39428e433ea44b088772db48df0
Instruction ID: 141a7034996c63ad7ff3bc7c0884ec27599e4e414b5f5d268e346ba4abd5d9c3
Opcode Fuzzy Hash: f79b629866164b0200903a3b8b11069d8512e39428e433ea44b088772db48df0
Instruction Fuzzy Hash: A4316F75A00219AFDB10DF54C885EAE7BF8EF09308F1480A9F909DB262D771EE45CB61

Function 00C441EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00C4424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00C44264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00C44271

Strings

msctls_trackbar32, xrefs: 00C44226

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 702e58df82401108e4ce61251338075300e802164cd6313ba3b93d7f20b0084f
Instruction ID: 29f647b8a11e0d6ba780c0867c4a2b06e728d2ca9ab1db248d2d654aa70332af
Opcode Fuzzy Hash: 702e58df82401108e4ce61251338075300e802164cd6313ba3b93d7f20b0084f
Instruction Fuzzy Hash: C211C271240248BEEF205F69CC46FAB3BACFF95B64F114624FA55E60A0D6B1DC519B20

Function 00C12F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB6B57: _wcslen.LIBCMT ref: 00BB6B6A

Part of subcall function 00C12DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C12DC5
Part of subcall function 00C12DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C12DD6
Part of subcall function 00C12DA7: GetCurrentThreadId.KERNEL32 ref: 00C12DDD
Part of subcall function 00C12DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00C12DE4

GetFocus.USER32 ref: 00C12F78

Part of subcall function 00C12DEE: GetParent.USER32(00000000), ref: 00C12DF9

GetClassNameW.USER32(?,?,00000100), ref: 00C12FC3
EnumChildWindows.USER32(?,00C1303B), ref: 00C12FEB

Strings

%s%d, xrefs: 00C12FFF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 2974421280ea6539540ca021b4edc6987555863937e0eb9102690839c2ab3845
Instruction ID: 1ae4f8a6c8267d2e8d84982741ae3aacc3b6a78eb243b1b5e20f80adf7cf29ad
Opcode Fuzzy Hash: 2974421280ea6539540ca021b4edc6987555863937e0eb9102690839c2ab3845
Instruction Fuzzy Hash: AC11A2756002056BDF547F60DCD6FED37AAAF8A304F048075B9099B252DE709A85EB70

Function 00C45882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00C458C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00C458EE
DrawMenuBar.USER32(?), ref: 00C458FD

Strings

0, xrefs: 00C4588F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: b39766d12ab9ea49ba448e04c50d5734b5ed9061582f43a2e841df669037ce42
Instruction ID: 03fe3326cc7a9606da3a9cd00873b646c426a4fb0e85bef5c303ea9d1fb746e8
Opcode Fuzzy Hash: b39766d12ab9ea49ba448e04c50d5734b5ed9061582f43a2e841df669037ce42
Instruction Fuzzy Hash: 1A018C31501219EFDB619F21DC44FAEBBB5FF46760F1080E9E849DA162DB308A85EF21

Function 00C1007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8f2d53fe8266403301b372aa743dd587f651d1f42a15ff582d7722828babbc
Instruction ID: 3c06b98cd670a9dfa4a37fc7a6930d9687d5e79bce7e536bb09d69d7c9ed8e1c
Opcode Fuzzy Hash: ae8f2d53fe8266403301b372aa743dd587f651d1f42a15ff582d7722828babbc
Instruction Fuzzy Hash: B1C15C75A0020AEFDB14CF94C898AAEB7B5FF49304F208598E515EB261D771DEC2DB90

Function 00BE3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BE3F0B
__alldvrm.LIBCMT ref: 00BE410C
__alldvrm.LIBCMT ref: 00BE412E

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: b1843a986cf9f1f9a822e32d41573a7fd0a5bf3a8bb23c71c7ceb2fcaf4a9a34
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: AFA12575E002C69FDB26CF1AC8917AABFE4EF65350F1845FDE5859B282C3388981C791

Function 00C3342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C33459
CoUninitialize.OLE32 ref: 00C33463
VariantInit.OLEAUT32(?), ref: 00C3346E
VariantClear.OLEAUT32(?), ref: 00C3371B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: e757ed3cff5141b216a7bf778f3e6cbc2bf67d174379ed6e91739cd6e818499c
Instruction ID: f900d8dc78b09fe37094031c545544abef8004f6e79963a05a93fa6c642e2a51
Opcode Fuzzy Hash: e757ed3cff5141b216a7bf778f3e6cbc2bf67d174379ed6e91739cd6e818499c
Instruction Fuzzy Hash: ACA15A756143009FC710DF28C596A6AB7E5FF89714F04889DF98A9B362DB70EE01CB92

Function 00C10436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00C4FC08,?), ref: 00C105F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00C4FC08,?), ref: 00C10608
CLSIDFromProgID.OLE32(?,?,00000000,00C4CC40,000000FF,?,00000000,00000800,00000000,?,00C4FC08,?), ref: 00C1062D
_memcmp.LIBVCRUNTIME ref: 00C1064E

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 628874c3a3f78744cf5b08e8e7247ff289ae45d860732f0322627718a52827b6
Instruction ID: e7234eafa748daa5f55eeaa172c44a4ba54146959c85292227262f8b92d3d344
Opcode Fuzzy Hash: 628874c3a3f78744cf5b08e8e7247ff289ae45d860732f0322627718a52827b6
Instruction Fuzzy Hash: 47812C71A00109EFCB04DF94C984EEEB7B9FF89315F204598F516AB250DB71AE86CB60

Function 00BF1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF14C0

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 04758bf326b32667b84acedb68ffca8ecf2c9c082c1e51e6d19520f894c95865
Instruction ID: 5797217f661df1df44c03453c521a9f70e4da810ea37ed0901b90af10d1f16b4
Opcode Fuzzy Hash: 04758bf326b32667b84acedb68ffca8ecf2c9c082c1e51e6d19520f894c95865
Instruction Fuzzy Hash: 6F417C31600109EBDB216BBD9C857BE7AE4EF81330F144EE6FA19D3392E73448095A71

Function 00C46278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C462E2
ScreenToClient.USER32(?,?), ref: 00C46315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00C46382

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: bbf09b34edfa5498c334762f47c766adf082d7cb2ccae95610937ec398af8d1e
Instruction ID: 4864084cb020c516820c88f86e2d739ff6b3f4186e36f8b9dc3fe92bbaaa4854
Opcode Fuzzy Hash: bbf09b34edfa5498c334762f47c766adf082d7cb2ccae95610937ec398af8d1e
Instruction Fuzzy Hash: CC516F74A00249EFCF24DF54D880AAE7BB5FF46360F108259F925972A4D730EE41CB51

Function 00C31AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00C31AFD
WSAGetLastError.WSOCK32 ref: 00C31B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00C31B8A
WSAGetLastError.WSOCK32 ref: 00C31B94

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 9b99b2e13f1743b5b9b054a01360649a437a51963e37da8ee12617ca2527138f
Instruction ID: 8c725d68f0037ea23e326db49bf07657e197af763b9238d267d281d7ae567d9c
Opcode Fuzzy Hash: 9b99b2e13f1743b5b9b054a01360649a437a51963e37da8ee12617ca2527138f
Instruction Fuzzy Hash: 4D418174640200AFE720AF24C886F7A77E5AB44718F58849CF91A9F7D2D7B2DD41CB90

Function 00BEB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777a327d275b53b69d1e653c412e29f1d461317e1df12bcf37f8af003e9f9d66
Instruction ID: 5d82ce39d085abe7b0819769beb54e2a5c1f3bcab37359539826643ecc913ffb
Opcode Fuzzy Hash: 777a327d275b53b69d1e653c412e29f1d461317e1df12bcf37f8af003e9f9d66
Instruction Fuzzy Hash: C041CFB5A00284AFD7249F79C841BABBBF9EB88710F1045AEF5469B282D771A9058780

Function 00C256D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00C25783
GetLastError.KERNEL32(?,00000000), ref: 00C257A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00C257CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00C257FA

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 3a572a9e500053468d9122a33612a10051b87cdfca2da9f80a385b5226e1a59a
Instruction ID: f8507c7aee62853b58b8867e6eee7ede32d0959da4001e070552eecc1110c1e1
Opcode Fuzzy Hash: 3a572a9e500053468d9122a33612a10051b87cdfca2da9f80a385b5226e1a59a
Instruction Fuzzy Hash: A6413E39610610DFCB21DF15C455A6EBBF2EF99720B18C488E85A9B762CBB4FD40CB91

Function 00BED8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00BD6D71,00000000,00000000,00BD82D9,?,00BD82D9,?,00000001,00BD6D71,8BE85006,00000001,00BD82D9,00BD82D9), ref: 00BED910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BED999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00BED9AB
__freea.LIBCMT ref: 00BED9B4

Part of subcall function 00BE3820: RtlAllocateHeap.NTDLL(00000000,?,00C81444,?,00BCFDF5,?,?,00BBA976,00000010,00C81440,00BB13FC,?,00BB13C6,?,00BB1129), ref: 00BE3852

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: b3d25a8f1480ff2f2fcbb4e5abe16be07f2cd7f8cf9ecf7be9175c71fbba7372
Instruction ID: ea5224b4e24b8dc5dae953db82a835bed3f14c676391358ed84acad147595412
Opcode Fuzzy Hash: b3d25a8f1480ff2f2fcbb4e5abe16be07f2cd7f8cf9ecf7be9175c71fbba7372
Instruction Fuzzy Hash: 1431EF72A0024AABDF24DF66DC85EAE7BE5EB41310F0502A9FC04D7261EB75CD50CBA0

Function 00C452C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00C45352
GetWindowLongW.USER32(?,000000F0), ref: 00C45375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C45382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C453A8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 7ec3fd39bbcce5c1d1550620afb7ccbf1856786ffeeba3a289cca1ec8697fc00
Instruction ID: ffea444e27711bc94ed67c782df3c1ec4ae5188b9cca2869b0cc53c1fb410904
Opcode Fuzzy Hash: 7ec3fd39bbcce5c1d1550620afb7ccbf1856786ffeeba3a289cca1ec8697fc00
Instruction Fuzzy Hash: 2531A035A56A08EFEB309F14CC46BE877A5BB05390F584141FA21962F2C7B4AE80EB41

Function 00C1AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00C1ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00C1AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00C1AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00C1ACC6

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 690fe6306d43458c5df08ef96a6c5997b4e6dc7e0baf1b4fd14efd90269accc5
Instruction ID: b942868738ef0861be28a7372b644ef0f1457b46f9ce4aeab0f944bf1f140b9d
Opcode Fuzzy Hash: 690fe6306d43458c5df08ef96a6c5997b4e6dc7e0baf1b4fd14efd90269accc5
Instruction Fuzzy Hash: 31310870A017186FEF35CB658C247FE7BA5AB87310F04421AE495922E1D3768AC5A7D2

Function 00C47674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00C4769A
GetWindowRect.USER32(?,?), ref: 00C47710
PtInRect.USER32(?,?,00C48B89), ref: 00C47720
MessageBeep.USER32(00000000), ref: 00C4778C

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 1aa512c544e7ca07fb05c6cacbb67e9c26f15e3d2484ca1d95d6100aacdd9068
Instruction ID: 3a550f83879fd79155fdbaf54307a4fcb603fae62381b2fd971a86e89d5bb311
Opcode Fuzzy Hash: 1aa512c544e7ca07fb05c6cacbb67e9c26f15e3d2484ca1d95d6100aacdd9068
Instruction Fuzzy Hash: 55416D38605214DFCB12CF58C894FAD77F9FF49324F5942A9E8249B261C731AA42CF90

Function 00C416DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00C416EB

Part of subcall function 00C13A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C13A57
Part of subcall function 00C13A3D: GetCurrentThreadId.KERNEL32 ref: 00C13A5E
Part of subcall function 00C13A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00C125B3), ref: 00C13A65

GetCaretPos.USER32(?), ref: 00C416FF
ClientToScreen.USER32(00000000,?), ref: 00C4174C
GetForegroundWindow.USER32 ref: 00C41752

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 4a74f1cea1aac2ad2d50fe2ab7b739042f0a5af4a9cb3770533288508775c510
Instruction ID: 826fe34a39b402e5027cfff91a709264e0d3a9d9f3825d041ae313cd7bcfdb92
Opcode Fuzzy Hash: 4a74f1cea1aac2ad2d50fe2ab7b739042f0a5af4a9cb3770533288508775c510
Instruction Fuzzy Hash: 0C311D75D00149AFCB00EFA9C8819FEBBF9FF49304B5480AAE455E7211DA759E45CBA0

Function 00C1DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00BB7620: _wcslen.LIBCMT ref: 00BB7625

_wcslen.LIBCMT ref: 00C1DFCB
_wcslen.LIBCMT ref: 00C1DFE2
_wcslen.LIBCMT ref: 00C1E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00C1E018

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 08872dcb88841631385cd4a270960f97963dafa00c3e6128504fde0e9e7d06fd
Instruction ID: 439b7b0e7297c97780717c1ec6dc14b3293ffc7fd85063d0cf2b3c3fce239a59
Opcode Fuzzy Hash: 08872dcb88841631385cd4a270960f97963dafa00c3e6128504fde0e9e7d06fd
Instruction Fuzzy Hash: 8B21E575900214AFCB20DFA8C881BAEB7F8EF4A750F1440A9E805FB341D7709E81DBA1

Function 00C1D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C1D501
Process32FirstW.KERNEL32(00000000,?), ref: 00C1D50F
Process32NextW.KERNEL32(00000000,?), ref: 00C1D52F
CloseHandle.KERNEL32(00000000), ref: 00C1D5DC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: fc5dee23743ecec3257ef9485be2c72e79cd2f7c222426ac86715ff9151b575a
Instruction ID: 31ee91551b9ce777fd4de20fb1e73525f0442426c96ab8c1f0729fe392c78243
Opcode Fuzzy Hash: fc5dee23743ecec3257ef9485be2c72e79cd2f7c222426ac86715ff9151b575a
Instruction Fuzzy Hash: EB318F711083009FD300EF54D881BFFBBE8EF9A354F14096DF586861A1EBB19A85DB92

Function 00C48FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BC9BB2

GetCursorPos.USER32(?), ref: 00C49001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00C07711,?,?,?,?,?), ref: 00C49016
GetCursorPos.USER32(?), ref: 00C4905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00C07711,?,?,?), ref: 00C49094

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 1e1623b8042478d729b7eadfdc0a839539c7d409abaa4374ed39e9457ad08421
Instruction ID: 3311cc0ca7c75c3a5d23b32dd0f49190b337c86aab5f3fc23fd2d15ed1612bfc
Opcode Fuzzy Hash: 1e1623b8042478d729b7eadfdc0a839539c7d409abaa4374ed39e9457ad08421
Instruction Fuzzy Hash: 56218D35601028AFDB25CF94C899FEF7BB9FB4A360F044059F91547261C7319A51EB60

Function 00C1D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00C4CB68), ref: 00C1D2FB
GetLastError.KERNEL32 ref: 00C1D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C1D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00C4CB68), ref: 00C1D376

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: b0cc7e7cd83355c5515af69b74c90dcf1d3e9991cfc83d72ef4af7b2ec035a0c
Instruction ID: 3c0b212aca56f58cb883eef6228b7453cfcbae8257863298323413dac8b14e2e
Opcode Fuzzy Hash: b0cc7e7cd83355c5515af69b74c90dcf1d3e9991cfc83d72ef4af7b2ec035a0c
Instruction Fuzzy Hash: 9F217C745092019F8710DF28C8819AE77E4BE56364F504A59F4AAC32B1DB70DA86DB93

Function 00C11571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C11014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C1102A
Part of subcall function 00C11014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C11036
Part of subcall function 00C11014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C11045
Part of subcall function 00C11014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00C1104C
Part of subcall function 00C11014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C11062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00C115BE
_memcmp.LIBVCRUNTIME ref: 00C115E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C11617
HeapFree.KERNEL32(00000000), ref: 00C1161E

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 4e86651bf21dce9c8754e16afcbd1d3f8aa606685b6ea776ce5aa1091f29ee46
Instruction ID: 23600c5d282648e18678346b467a0b7058af30505ad5775f7add16d67d15766f
Opcode Fuzzy Hash: 4e86651bf21dce9c8754e16afcbd1d3f8aa606685b6ea776ce5aa1091f29ee46
Instruction Fuzzy Hash: 3B21BD31E01108EFDF00DFA4C944BEEB7B9EF86354F084459E911AB251E735AA85EBA0

Function 00C42782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00C4280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C42824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C42832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00C42840

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: b25c5aa6b7abc1451dc316c1e1e00dd203988e63e5c5148039d90e64dcfd711a
Instruction ID: 797155a82c6e1f5938b5e1238285cbc89155c3c769026c14ff209cdf2650af8a
Opcode Fuzzy Hash: b25c5aa6b7abc1451dc316c1e1e00dd203988e63e5c5148039d90e64dcfd711a
Instruction Fuzzy Hash: ED21D335205111AFD714DB24C886FAE7BA9FF46324F148158F4268B6E2CBB1FD82CB90

Function 00C178F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C18D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00C1790A,?,000000FF,?,00C18754,00000000,?,0000001C,?,?), ref: 00C18D8C
Part of subcall function 00C18D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00C18DB2
Part of subcall function 00C18D7D: lstrcmpiW.KERNEL32(00000000,?,00C1790A,?,000000FF,?,00C18754,00000000,?,0000001C,?,?), ref: 00C18DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00C18754,00000000,?,0000001C,?,?,00000000), ref: 00C17923
lstrcpyW.KERNEL32(00000000,?), ref: 00C17949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00C18754,00000000,?,0000001C,?,?,00000000), ref: 00C17984

Strings

cdecl, xrefs: 00C1797B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: ba84c6adb7e5102fe0f82332e5b796eb52d8c5566294c0b67f3e2c17e77283a9
Instruction ID: 2520c8b99a3185fbac72b42508851a494ce16d1547d6bde5b8d2cc6cd94a8df5
Opcode Fuzzy Hash: ba84c6adb7e5102fe0f82332e5b796eb52d8c5566294c0b67f3e2c17e77283a9
Instruction Fuzzy Hash: 0C11063A200302ABCF15AF34D844EBA77B5FF86350B10412AF906C73A4EB319945E791

Function 00C47CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00C47D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00C47D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00C47D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00C2B7AD,00000000), ref: 00C47D6B

Part of subcall function 00BC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BC9BB2

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 1de0bc628a01fdfd5241c83e177908d9ab2dc2a3df445e9abc35e170ac9fc8ce
Instruction ID: 3227b693be66986a2588e483a0d04abeb72c64ec15b4cb8c8d91deace1c3b9aa
Opcode Fuzzy Hash: 1de0bc628a01fdfd5241c83e177908d9ab2dc2a3df445e9abc35e170ac9fc8ce
Instruction Fuzzy Hash: A0119D35A15615AFCB109F28CC44BAA3BA9BF46360B258724F839D72F0E7349A51DB50

Function 00C45660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00C456BB
_wcslen.LIBCMT ref: 00C456CD
_wcslen.LIBCMT ref: 00C456D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C45816

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 64075dcae4fe18e28b8141aab9afb1356a885514f566a48f30b7802eb35b312c
Instruction ID: 49c6274b0542d538cab833e97f68feacc10cad970e3eafa1f127625e5c54f23f
Opcode Fuzzy Hash: 64075dcae4fe18e28b8141aab9afb1356a885514f566a48f30b7802eb35b312c
Instruction Fuzzy Hash: E211D375A00608ABDF209F62CC85AEE77ACFF11764B104066F925D6182EB70CA85CB64

Function 00BE1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839eabb4539dbf5351fa8d2ddc788d17b7156583b0ba41a187936fbe9cfa8e3f
Instruction ID: 2b22c1a77bc9831870e14d9141638002ded94d2f1a89b6aaa21dfe3cb3cd1f22
Opcode Fuzzy Hash: 839eabb4539dbf5351fa8d2ddc788d17b7156583b0ba41a187936fbe9cfa8e3f
Instruction Fuzzy Hash: 3201D6B220569A3EF611167E6CC1F2B669CEF813B8F314BB5F531612D2DB758C004170

Function 00BC990F Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,?), ref: 00BC98D6
SetBkMode.GDI32(?,00000001), ref: 00BC98E9
GetStockObject.GDI32(00000005), ref: 00BC98F1
GetWindowLongW.USER32(?,000000EB), ref: 00BC9952

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ColorLongModeObjectStockTextWindow
String ID:
API String ID: 2960364272-0
Opcode ID: ca787dc7bbec775aa9477db5187ae7e220693d519302c51c7fd341f62987a487
Instruction ID: 42262fe47507a267bb505d81ad8aa9ad931c4d3dfc385fa67091a331980f5d5c
Opcode Fuzzy Hash: ca787dc7bbec775aa9477db5187ae7e220693d519302c51c7fd341f62987a487
Instruction Fuzzy Hash: 6D1136361462508BEB128F24ECA8FEE3BA4EF13371B0801DDE9428B1B2C7714850CBA1

Function 00C11A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00C11A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C11A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C11A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C11A8A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2f23d878648c150d5768ec9a8d7414511b9c7c6f13645f41f79a09dd1e0cb32f
Instruction ID: 1795bcc9e150bce1fa90dde09513af8d6a8f0c0334e296fb8b32b89d472df487
Opcode Fuzzy Hash: 2f23d878648c150d5768ec9a8d7414511b9c7c6f13645f41f79a09dd1e0cb32f
Instruction Fuzzy Hash: 5011273A901219FFEB109BA5C985FEDBB78EF09750F240091EA00B7290D6716E50EB94

Function 00C1E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C1E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00C1E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00C1E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00C1E24D

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 72489bebe97ccaa47f5ad03bec6b8b50a4ec66177dd8b40734516a29f3c8b435
Instruction ID: cd4581cd30bcbca6912763c7095a6697077a9c0e5836caf2a57fb7a2f3bb34e0
Opcode Fuzzy Hash: 72489bebe97ccaa47f5ad03bec6b8b50a4ec66177dd8b40734516a29f3c8b435
Instruction Fuzzy Hash: 0411D676A04258BBC7019FA8DC49BDE7FECAB47320F144265FD24E32A1D6B0DE4587A0

Function 00BDD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00BDCFF9,00000000,00000004,00000000), ref: 00BDD218
GetLastError.KERNEL32 ref: 00BDD224
__dosmaperr.LIBCMT ref: 00BDD22B
ResumeThread.KERNEL32(00000000), ref: 00BDD249

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 55c9e1fb2155e64a7ae21882788acd39558d000bdec2c14ab240040e97fc2722
Instruction ID: ef8ead90989bd256c258e6316dfe0e1fcd090395ea351372788c9fa36d8908e0
Opcode Fuzzy Hash: 55c9e1fb2155e64a7ae21882788acd39558d000bdec2c14ab240040e97fc2722
Instruction Fuzzy Hash: A901D6364051057BC7115BA5DC45BAEFAEDEF82330F10029AF965922E0EB71C905C6A0

Function 00C49EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00BC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BC9BB2

GetClientRect.USER32(?,?), ref: 00C49F31
GetCursorPos.USER32(?), ref: 00C49F3B
ScreenToClient.USER32(?,?), ref: 00C49F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00C49F7A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 35ad210eac8849b82972c04ac605402caa989d5f3023ce81d89d769b5a3acfad
Instruction ID: a48fe539468835bfe820e0c2f6088e3ec98a15c6c3aa26e1269b1805143aadf9
Opcode Fuzzy Hash: 35ad210eac8849b82972c04ac605402caa989d5f3023ce81d89d769b5a3acfad
Instruction Fuzzy Hash: 0F11483690112AABEB00DFA8D889AEE77B8FB46311F000455F911E3150D734BF86DBA5

Function 00BB600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00BB604C
GetStockObject.GDI32(00000011), ref: 00BB6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BB606A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 013e1191fdcf5605fe519a9bfa29f88d91145603e3de3a5f1a0ee9ca094a520c
Instruction ID: e9e1dd4b22db7074f2e5c3e0addcbeba76d4dbb595a8215e9cc2a123227607b5
Opcode Fuzzy Hash: 013e1191fdcf5605fe519a9bfa29f88d91145603e3de3a5f1a0ee9ca094a520c
Instruction Fuzzy Hash: 4D11AD72102508BFEF165FA58C84FFEBBA9FF093A4F440245FA1452020D7769C60DBA0

Function 00BD3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00BD3B56

Part of subcall function 00BD3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00BD3AD2
Part of subcall function 00BD3AA3: ___AdjustPointer.LIBCMT ref: 00BD3AED

_UnwindNestedFrames.LIBCMT ref: 00BD3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00BD3B7C
CallCatchBlock.LIBVCRUNTIME ref: 00BD3BA4

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 14481bc0a712ebb0cb669fbc658258c7ebdd7b941de54d6f7555af8a24532a89
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 2D012D32100148BBDF115F95CC46EEBBFE9EF48B54F04405AFE4856222E732D961DBA1

Function 00BE3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00BB13C6,00000000,00000000,?,00BE301A,00BB13C6,00000000,00000000,00000000,?,00BE328B,00000006,FlsSetValue), ref: 00BE30A5
GetLastError.KERNEL32(?,00BE301A,00BB13C6,00000000,00000000,00000000,?,00BE328B,00000006,FlsSetValue,00C52290,FlsSetValue,00000000,00000364,?,00BE2E46), ref: 00BE30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00BE301A,00BB13C6,00000000,00000000,00000000,?,00BE328B,00000006,FlsSetValue,00C52290,FlsSetValue,00000000), ref: 00BE30BF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 584e151de048b6a164aa859b7ef8d91c52bf75881db54e4d0349caf36413a39e
Instruction ID: 526872b1b6c0a6153bc66a470cbbdb46fa4835ab3d8d1908903f0cbd4c7e0ea0
Opcode Fuzzy Hash: 584e151de048b6a164aa859b7ef8d91c52bf75881db54e4d0349caf36413a39e
Instruction Fuzzy Hash: E901F736702262ABCB318BBA9C8CB6B7BD8EF46F61B240660F905E3151C721D901C6E0

Function 00C17464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00C1747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00C17497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00C174AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00C174CA

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 0b50171608fd7be827485b7751b67241efb5b7dadfddcb78f8ca12d92284e167
Instruction ID: b06855bab276f2620d0fbe727a5879c0c4e42b27e33d6dc975aeca40a0a1cdae
Opcode Fuzzy Hash: 0b50171608fd7be827485b7751b67241efb5b7dadfddcb78f8ca12d92284e167
Instruction Fuzzy Hash: 6511A1B52063109BE7208F14DD48BE67BFCFB01B00F108669A666D6161D770E984EF50

Function 00C1B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00C1ACD3,?,00008000), ref: 00C1B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00C1ACD3,?,00008000), ref: 00C1B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00C1ACD3,?,00008000), ref: 00C1B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00C1ACD3,?,00008000), ref: 00C1B126

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: b74e22e7264102926c119bd10b762c151a31522ba085816bc455492caaa3a1e3
Instruction ID: 056717b1f08fcbec0a8855e800ed855f3c16cecf58f8b95109f4e55e2496707b
Opcode Fuzzy Hash: b74e22e7264102926c119bd10b762c151a31522ba085816bc455492caaa3a1e3
Instruction Fuzzy Hash: FA115B71C0292CE7CF00AFE5E998BEEBF78FF4A711F214085D951B2191CB309A909B51

Function 00C47E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C47E33
ScreenToClient.USER32(?,?), ref: 00C47E4B
ScreenToClient.USER32(?,?), ref: 00C47E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C47E8A

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: e6e79443f711894e1ebbeba93ca59baff50e00b320da84cd868a65d63d10ded6
Instruction ID: b724d293d57ccad90931f7f8fba6e2772889102fda5fafb59f319a18f886f1ad
Opcode Fuzzy Hash: e6e79443f711894e1ebbeba93ca59baff50e00b320da84cd868a65d63d10ded6
Instruction Fuzzy Hash: F01144B9D0020AAFDB41CF98C884AEEBBF5FF09310F509156E915E3220D735AA54CF50

Function 00C12DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C12DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C12DD6
GetCurrentThreadId.KERNEL32 ref: 00C12DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00C12DE4

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 5df89ff3f3b1fbe9f05f322f2b4036aeebf3891f9f3c8ad6dc4de68b17e99157
Instruction ID: 3582d0afa4813370857c5f042ef956f4f491289b8101392596e98c9542115965
Opcode Fuzzy Hash: 5df89ff3f3b1fbe9f05f322f2b4036aeebf3891f9f3c8ad6dc4de68b17e99157
Instruction Fuzzy Hash: 38E06D79602228BAD7202BA2EC8DFEF3E6CFB43BA1F014015B105D10A09AA08980D6B0

Function 00C48863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00BC9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BC9693
Part of subcall function 00BC9639: SelectObject.GDI32(?,00000000), ref: 00BC96A2
Part of subcall function 00BC9639: BeginPath.GDI32(?), ref: 00BC96B9
Part of subcall function 00BC9639: SelectObject.GDI32(?,00000000), ref: 00BC96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00C48887
LineTo.GDI32(?,?,?), ref: 00C48894
EndPath.GDI32(?), ref: 00C488A4
StrokePath.GDI32(?), ref: 00C488B2

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: d68c37b1ec28d21605f01d9edd56da1d8cceb68a6c7d7e01cbb30879744cabfd
Instruction ID: 125e697bb966bad5119395d86b4578a7263723f50e53ff2744a165941deb3bad
Opcode Fuzzy Hash: d68c37b1ec28d21605f01d9edd56da1d8cceb68a6c7d7e01cbb30879744cabfd
Instruction Fuzzy Hash: 7EF03A3A042258BAEB125F94AC09FCE3E59BF06710F048100FA12650E2C7755611CBA9

Function 00BC98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00BC98CC
SetTextColor.GDI32(?,?), ref: 00BC98D6
SetBkMode.GDI32(?,00000001), ref: 00BC98E9
GetStockObject.GDI32(00000005), ref: 00BC98F1

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 8a29b34c4f97e086259cca588303ee3cf826ac36cab35cc0aefa89676b97fc20
Instruction ID: cf81a2dbefc4ad58db9afac45a4e1244069b661ab6fc57c82c0ae89a3b04aa01
Opcode Fuzzy Hash: 8a29b34c4f97e086259cca588303ee3cf826ac36cab35cc0aefa89676b97fc20
Instruction Fuzzy Hash: 9BE06D35645280AAEB615B74AC49BEC3F60FB16336F048319F6FA580F1C7B15640DF10

Function 00C1162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00C11634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00C111D9), ref: 00C1163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00C111D9), ref: 00C11648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00C111D9), ref: 00C1164F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: e8625a090be229f7d403b1077c701aceb171a7677d9b63928d4717dd3e2842ee
Instruction ID: 6b1e9618d9a4654af444fd22c1d1ffc1435f45810be80c28d89e5728cdb4705c
Opcode Fuzzy Hash: e8625a090be229f7d403b1077c701aceb171a7677d9b63928d4717dd3e2842ee
Instruction Fuzzy Hash: 0AE04F35602211DBD7B01FA09D4DB8A3B68FF467A1F184808F655C90A0D66845808B50

Function 00C0D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00C0D858
GetDC.USER32(00000000), ref: 00C0D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00C0D882
ReleaseDC.USER32(?), ref: 00C0D8A3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: a86cfe2d98ad0ddc4a6f29a96ec71808f66bfc43135b4e5c9612413cbad0dc46
Instruction ID: a63a4e0d6a03ac1762e2b8685acb5a652c429d66a88bb0e4f9a0ebe1ea29d221
Opcode Fuzzy Hash: a86cfe2d98ad0ddc4a6f29a96ec71808f66bfc43135b4e5c9612413cbad0dc46
Instruction Fuzzy Hash: 14E01AB8801204DFCB819FA0D888BADBBF1FB09310F11C099F816E7260C7388901EF40

Function 00C0D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00C0D86C
GetDC.USER32(00000000), ref: 00C0D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00C0D882
ReleaseDC.USER32(?), ref: 00C0D8A3

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: dde824895d1b38effe5f04d7aa6681a6f8a1cff4d48b724858f513d53bc3839e
Instruction ID: 6c452d592986aa9b7ca691c0a7a8040f14466c1d053f63d60e1954279792c295
Opcode Fuzzy Hash: dde824895d1b38effe5f04d7aa6681a6f8a1cff4d48b724858f513d53bc3839e
Instruction Fuzzy Hash: 70E01A78801200DFCB909FA0D8887ADBBF1BB08310B118048F81AE7260C73859019F40

Function 00C24D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB7620: _wcslen.LIBCMT ref: 00BB7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00C24ED4

Strings

*, xrefs: 00C24E10
LPT, xrefs: 00C24DFB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 72c7826bd4a258ec556eed2e7805619e36e715475ce9e41d4ec935a1c81e9ba1
Instruction ID: dc20adeffa77f7f2edd940c69c901ef7735799f3dcc17f6941514ad97653b6c4
Opcode Fuzzy Hash: 72c7826bd4a258ec556eed2e7805619e36e715475ce9e41d4ec935a1c81e9ba1
Instruction Fuzzy Hash: B8918175A00214DFDB18DF98D584EAABBF1BF84304F158099E41A9F762C771EE85CB90

Function 00BDE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00BDE30D

Strings

pow, xrefs: 00BDE2E5, 00BDE302

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 5791dd0cef295267ad27c0342664db68263ea342495aaad9b308748efd38919d
Instruction ID: c098f12692761c6e4f70ba7cd32602b877d0a08ad7320e8be9aaa29c3c32ee50
Opcode Fuzzy Hash: 5791dd0cef295267ad27c0342664db68263ea342495aaad9b308748efd38919d
Instruction Fuzzy Hash: 62518DA1A4C24296CB167715CD4177D7BE8DB00751F348AEAE0A54B3E9FF30CCC19A8A

Function 00BCE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00BCE1B1

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: a58b3fbea3f008f1c61c6acc10d64c9637006122dbc5b68dd0eb5029b7e9585d
Instruction ID: bc698e93b1ca9acdcf24054c7aed947968fe9ad22b7faeb7b51b6b64a84492be
Opcode Fuzzy Hash: a58b3fbea3f008f1c61c6acc10d64c9637006122dbc5b68dd0eb5029b7e9585d
Instruction Fuzzy Hash: EB510175644246DFDB25DF28C481BFA7BE8EF55310F288499E8A19B2D0D734DE42CBA0

Function 00BCF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00BCF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00BCF2BB

Strings

@, xrefs: 00BCF2AF

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 084ad54d3dd5ffa97139dfb5c8c785ca0628f3d4707e2f34e8aafa66c110c918
Instruction ID: 514e6e687b5b7db6bc75d6de5fdbcc9b59f0178d2bb0375091a2081f003f68e5
Opcode Fuzzy Hash: 084ad54d3dd5ffa97139dfb5c8c785ca0628f3d4707e2f34e8aafa66c110c918
Instruction Fuzzy Hash: D15136714087449BD320AF11DC86BBFBBF8FB84300F81889DF5D9811A5EBB08529CB66

Function 00C35745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00C357E0
_wcslen.LIBCMT ref: 00C357EC

Strings

CALLARGARRAY, xrefs: 00C357E6, 00C357EB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: fbb3e152fe751ea7b7ed1f3c44cb4766d660de5dfb1082e7c485c8a324fe2d0a
Instruction ID: 7d05c9b5f104fab559fc9682d37598c6ea103f945dc4b94d9f15c7c618f6d605
Opcode Fuzzy Hash: fbb3e152fe751ea7b7ed1f3c44cb4766d660de5dfb1082e7c485c8a324fe2d0a
Instruction Fuzzy Hash: 4141AE71E102099FCB14DFA9C8819FEBBF5FF59324F104069E515A7291E7709E81CBA1

Function 00C2D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C2D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00C2D13A

Strings

|, xrefs: 00C2D10B

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 3ff4a3232ad208a14e4b0ae139563545f0da11ab252b271f02b529ae9c38c7d5
Instruction ID: 0ad99329d1f9e6b25d85f8ad6b833f68fa3a0d4c454f6e2ee57f9aa7d609106b
Opcode Fuzzy Hash: 3ff4a3232ad208a14e4b0ae139563545f0da11ab252b271f02b529ae9c38c7d5
Instruction Fuzzy Hash: 48313E71D00219AFCF15EFA5DC85AEEBFB9FF14310F100059F815A61A2E775AA16CB50

Function 00C4356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00C43621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00C4365C

Strings

static, xrefs: 00C435BC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: f51d7c2c11fd21de7115542e57584554aca003e965345a353c2ac5d0600343f2
Instruction ID: 4f3ca883191252a88b3cca49f7897d2d7086402485b60a455051ec077bff370d
Opcode Fuzzy Hash: f51d7c2c11fd21de7115542e57584554aca003e965345a353c2ac5d0600343f2
Instruction Fuzzy Hash: B7319C71110244AEDB10DF28DC81FFB73A9FF88720F018619F9A597290DA30AE91D764

Function 00C44537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00C4461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C44634

Strings

', xrefs: 00C4458E

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 0ec94ad12c2cf02d55f87ffc73aed75b79173f30864292cf6aa57ab8fe0b9c31
Instruction ID: 5f1bd13fadaae44facee4a6e8fb872ac503e65f7f57c5c1ea1de159fe26efadf
Opcode Fuzzy Hash: 0ec94ad12c2cf02d55f87ffc73aed75b79173f30864292cf6aa57ab8fe0b9c31
Instruction Fuzzy Hash: DE3118B4A012099FDF18CFA9C991BDABBF5FF49300F25406AE915AB351D770AA41CF90

Function 00C431EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00C4327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C43287

Strings

Combobox, xrefs: 00C43249

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 5d3498ffea18820cb1060f3320ff35064f5cd467056bfdbec63505c83e237d6d
Instruction ID: 8e669c8b189c0848e7eea57eda35030b7d50e10e7aa8987ffc43a72cd26a54eb
Opcode Fuzzy Hash: 5d3498ffea18820cb1060f3320ff35064f5cd467056bfdbec63505c83e237d6d
Instruction Fuzzy Hash: 8511B2713002487FFF259E54DC81FBB37AAFB943A4F104225F92897292D6B19E518760

Function 00C43710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00BB600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00BB604C
Part of subcall function 00BB600E: GetStockObject.GDI32(00000011), ref: 00BB6060
Part of subcall function 00BB600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BB606A

GetWindowRect.USER32(00000000,?), ref: 00C4377A
GetSysColor.USER32(00000012), ref: 00C43794

Strings

static, xrefs: 00C43757

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: f750b88ecff3f435d23cd98f04389aed47929d19e8b68b12193876a268165ce7
Instruction ID: 6dbc5cecc09520e35662922ee563d3760d78f978600d99d5bbf821d8b5dfba62
Opcode Fuzzy Hash: f750b88ecff3f435d23cd98f04389aed47929d19e8b68b12193876a268165ce7
Instruction Fuzzy Hash: 731159B2610209AFDB00DFA8CC46AEE7BF8FB09304F004514FDA5E2250D735E9119B50

Function 00C2CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00C2CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00C2CDA6

Strings

<local>, xrefs: 00C2CD66

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 79ce6d437c14d93c67f6c0054f825e6d382d071331c3dae361ac503be3760a15
Instruction ID: 62a8c2ceb6c975efbd8d8408997e2e86937eba5bc519a92bc0661ee5863ef34e
Opcode Fuzzy Hash: 79ce6d437c14d93c67f6c0054f825e6d382d071331c3dae361ac503be3760a15
Instruction Fuzzy Hash: 50110675201A317AD7344B669CC4FEBBE6CEF127A4F004236F11983480D3709944D6F0

Function 00C43429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00C434AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00C434BA

Strings

edit, xrefs: 00C4348F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 6a7974869979fff587a0ae9be4df0d6f9c7111d2549861ec69371dd8a0ad8626
Instruction ID: 4a94f5f492bd27189af10ea2b1826f055d4eb7610178ea805c4c3c42849fe779
Opcode Fuzzy Hash: 6a7974869979fff587a0ae9be4df0d6f9c7111d2549861ec69371dd8a0ad8626
Instruction Fuzzy Hash: 4C119A71200248ABEB129E64DC84BEA3BAAFB95374F505324F970931E0C775DE519B60

Function 00C16C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00C16CB6
_wcslen.LIBCMT ref: 00C16CC2

Strings

STOP, xrefs: 00C16CBC, 00C16CC1

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: d8314506fa23281a0c870e5a5b55a2f74e143ff78427289ecc310334961569d9
Instruction ID: 4909725e18d2b1b9230b700026409f334d43f1f4482136ab0c31368589052d5f
Opcode Fuzzy Hash: d8314506fa23281a0c870e5a5b55a2f74e143ff78427289ecc310334961569d9
Instruction Fuzzy Hash: 9A01D232A105268BCB20AFFDDC909FF77F5FB627107500968E86297190EB71DA80D790

Function 00C11CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00C13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C13CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00C11D4C

Strings

ListBox, xrefs: 00C11D16
ComboBox, xrefs: 00C11CEB

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ea612ef2b162a56d4b803e91cd2917022e58dfea966af8b92eb601a70654efa6
Instruction ID: ef7c970dbcfa858b4ac0fa49180df78cb7e49c95c25169d82a698c3d2e6e635b
Opcode Fuzzy Hash: ea612ef2b162a56d4b803e91cd2917022e58dfea966af8b92eb601a70654efa6
Instruction Fuzzy Hash: 96012431601218AB8B09FBA0DC51DFE77A8FB03390B180619FD32673C1EA745948E660

Function 00C11BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00C13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C13CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00C11C46

Strings

ListBox, xrefs: 00C11C10
ComboBox, xrefs: 00C11BE5

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: bf955fa3c6a7829f165f82344a3c99749c1b2b61616aadc80d6f232d95d44328
Instruction ID: be50def9aaef11c6ac4eaaec56d496186d9c21161beee2cce946b03066a0eb5a
Opcode Fuzzy Hash: bf955fa3c6a7829f165f82344a3c99749c1b2b61616aadc80d6f232d95d44328
Instruction Fuzzy Hash: E9016775781108A7CB14EB90CD61AFF77E89B17380F140059BA1667281EA649F48A6F1

Function 00C11C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00C13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C13CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00C11CC8

Strings

ListBox, xrefs: 00C11C94
ComboBox, xrefs: 00C11C69

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: abd8df7945d843cb3f01baa0d4765bf1b54cf123926c2ab26c24e2de21520902
Instruction ID: 084225848196a269ce30194a5351de3d639daf60aed9e4399d9bc8986cd11049
Opcode Fuzzy Hash: abd8df7945d843cb3f01baa0d4765bf1b54cf123926c2ab26c24e2de21520902
Instruction Fuzzy Hash: BC01D67568111867CF04EBA4CE61AFF77E89B13380F180015BE0673281EAA49F48E6F1

Function 00C11D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB9CB3: _wcslen.LIBCMT ref: 00BB9CBD

Part of subcall function 00C13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C13CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00C11DD3

Strings

ListBox, xrefs: 00C11DA0
ComboBox, xrefs: 00C11D75

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e5bf1601768716205b61b091628a2883877da7c849ef483449152ce596bda818
Instruction ID: 77004bdd7cceb02d42714496ee561f293db7a26d9b45b970732d613640ba7142
Opcode Fuzzy Hash: e5bf1601768716205b61b091628a2883877da7c849ef483449152ce596bda818
Instruction Fuzzy Hash: 25F0CD71B5121867DB05F7A4DC91FFF77B8AB03390F140915BD26632C1EAA45A489260

Function 00C3747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C37493
_wcslen.LIBCMT ref: 00C374B9

Strings

3, 3, 16, 1, xrefs: 00C37483

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: d6c88c031454d335d2e771bf14c4d0c60dc2657807902aa920471cf88546536d
Instruction ID: 2a7ec669c8fd5dbca7ed4033ffa0efcd8899a20a7a48b6c04757f7fccd2e1485
Opcode Fuzzy Hash: d6c88c031454d335d2e771bf14c4d0c60dc2657807902aa920471cf88546536d
Instruction Fuzzy Hash: 8BE06182324320259331237BDCC197F96C9CFC9790B10192BF9C5C2366FBA8DE9193A0

Function 00C10B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00C10B23

Strings

Error allocating memory., xrefs: 00C10B1C
AutoIt, xrefs: 00C10B17

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 53e609620cfb207d5f6f7570d5832cd594696c955aa7477d6b7e7b167759fffd
Instruction ID: ca91d0ffd2ea7e17d9aa1944f2106169f79967a746c8f890e1ed39d9cb2136d3
Opcode Fuzzy Hash: 53e609620cfb207d5f6f7570d5832cd594696c955aa7477d6b7e7b167759fffd
Instruction Fuzzy Hash: 95E0D83128531937D21437957C43FD97BC49F05B21F1044BAFB98555D38AE1289006E9

Function 00BD0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BCF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00BD0D71,?,?,?,00BB100A), ref: 00BCF7CE

IsDebuggerPresent.KERNEL32(?,?,?,00BB100A), ref: 00BD0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00BB100A), ref: 00BD0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00BD0D7F

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 1ccdb2b4fda3eba2a99c31c92f637e49cb15f66da0f3a55735cd8a17ec361939
Instruction ID: c728d31762f6a5507f284d0c8d8c744a7f520614dc2a0617e5850e40e426fc77
Opcode Fuzzy Hash: 1ccdb2b4fda3eba2a99c31c92f637e49cb15f66da0f3a55735cd8a17ec361939
Instruction Fuzzy Hash: 93E06DB42003018BD770AFB9E444756BBE5BB04741F0089BEE882C6761EBF4E4458BA1

Function 00C23017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00C2302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00C23044

Strings

aut, xrefs: 00C23038

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 57d0e0b38a689c49ad51676fdec8e7767ab2ef36700174ffffed21584318cbc1
Instruction ID: 6350ff4d0805f39df65ca5240afd9e74aa03cfe85fc1f7bf5a19070c99ce60ec
Opcode Fuzzy Hash: 57d0e0b38a689c49ad51676fdec8e7767ab2ef36700174ffffed21584318cbc1
Instruction Fuzzy Hash: B6D05EB650132867DA70A7A5AC4EFCB3A6CEB05760F0002A1B655E20A1DAF49984CAD4

Function 00C0D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C0D220

Strings

%.3d, xrefs: 00C0D22B
X64, xrefs: 00C0D2A8

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 4535e2483cf168d653878259ef987b70984fc5d30fce2d4889138620156cecfb
Instruction ID: d28ad4f70c3e0e6950c4c1bb5917292f1c20f31b6b29687c68f1269db6ec69d7
Opcode Fuzzy Hash: 4535e2483cf168d653878259ef987b70984fc5d30fce2d4889138620156cecfb
Instruction Fuzzy Hash: BDD012A5809119EACB9097D1CC85EB9B3BCBB08301F5084A6F80B91080D724CD08EB61

Function 00C42356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C4236C
PostMessageW.USER32(00000000), ref: 00C42373

Part of subcall function 00C1E97B: Sleep.KERNELBASE ref: 00C1E9F3

Strings

Shell_TrayWnd, xrefs: 00C42365

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: abd190ded549b7adcd6e1e781b9a6d5ec4349b9137e64e4b29675de39333ca65
Instruction ID: d617d3ff6131a68cb65b8c4cfc5bdb9c97a3319493b60f236d00128e1ce0acf9
Opcode Fuzzy Hash: abd190ded549b7adcd6e1e781b9a6d5ec4349b9137e64e4b29675de39333ca65
Instruction Fuzzy Hash: 73D022363C23007BE2A8B331EC4FFCE7614AB02B00F0089127706EA0E0C8F0B840CA04

Function 00C42322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C4232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00C4233F

Part of subcall function 00C1E97B: Sleep.KERNELBASE ref: 00C1E9F3

Strings

Shell_TrayWnd, xrefs: 00C42325

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 4cce0e2319d4a4d575eed64fa2d3509f9761725390d7ed6b625e194b1280c44b
Instruction ID: cafb4d27d05e8d19069530c57d901c68c7fdbd8adefcde7824542b19f21b2618
Opcode Fuzzy Hash: 4cce0e2319d4a4d575eed64fa2d3509f9761725390d7ed6b625e194b1280c44b
Instruction Fuzzy Hash: CAD0223A385300B7E2A8B331EC4FFCE7A14AB01B00F008912770AEA0E0C8F0A840CA00

Function 00BEBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00BEBE93
GetLastError.KERNEL32 ref: 00BEBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BEBEFC

Memory Dump Source

Source File: 00000000.00000002.3062270802.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.3062206996.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062394245.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062448409.0000000000C7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3062486683.0000000000C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: c2cc3e892794ad24281946c194266d72819e40c6334f94275217bf36a4656a91
Instruction ID: 86dc28cb73998354e7ff9a75162240cba97640e4e3520ce467cfe4efe7fbc967
Opcode Fuzzy Hash: c2cc3e892794ad24281946c194266d72819e40c6334f94275217bf36a4656a91
Instruction Fuzzy Hash: 6441A435605286ABCB218F66CC94FBBBBE5EF41310F1441E9F959572A1DB308D01DBA0

Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725564459&P2=404&P3=2&P4=MZReESQeVdQg%2bJMGXuyS5L3qgKqqDGoyQdusNtTtWbr%2bh6DiWjtALUMkh96rqeTXSybXZjSbukRLDWYH%2bACr3A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: xqNstlXKEeAb07QJRLVctDSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tByBeEzz9nxcwEy&MD=gydSm56F HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725564459&P2=404&P3=2&P4=MZReESQeVdQg%2bJMGXuyS5L3qgKqqDGoyQdusNtTtWbr%2bh6DiWjtALUMkh96rqeTXSybXZjSbukRLDWYH%2bACr3A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: xqNstlXKEeAb07QJRLVctDSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tByBeEzz9nxcwEy&MD=gydSm56F HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.206
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.68

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1ad9ba44-1215-44af-b515-57a9d6bd57ff.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2ea25989-3069-4732-998f-28166adf5e8f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\32178d96-5683-4e46-9ca2-dcbad3c044da.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3f1e711e-ee30-4ff0-91bb-81bf9057fe03.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5655f4e1-77a2-46df-a99a-d00bcb364af7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5a9f00a4-4714-49eb-88c6-662734bbaf38.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\71add3dd-bb72-4124-bde8-935b86ba9009.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7a6434c7-f1c4-4d05-a607-718eb2903649.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\96490169-4e4c-4809-a89a-b3ca12d2bb2d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D0CB93-14E0.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D0CB93-258.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3d05671d-b3d1-4f07-a841-a136dca3f7c1.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\4517fe76-5cf1-4c8f-89bc-1434729b91a0.tmp

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre