Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1501616
MD5:	f7d0bcf3675717c5157e215474ea4b5b
SHA1:	16282144ef49ecb4f788c9b2e2a641ec0b5e8917
SHA256:	bf404a32bc8915774c6653217952c2f8af53e30685823de207277f5211909b8e
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6764 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F7D0BCF3675717C5157E215474EA4B5B)

msedge.exe (PID: 6816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1308 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2072,i,8180152950127741794,4817546992404905651,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5408 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7260 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2696 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8456 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8464 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6496 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8552 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7228 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8592 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7228 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8848 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9092 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2964 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9208 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4372 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9220 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6060 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9228 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6060 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9684 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1228 --field-trial-handle=2108,i,2381369830628417293,13375159391065227036,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 10224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7792 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2092,i,513492404789473333,1937958185482303577,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1996,i,13354447204659382061,17860069164876913799,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2892621669.0000000001180000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2892621669.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.11.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.11.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.11.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 700c49c8-a9fa-49b3-b0b2-ea78459e6fc7.tmp.12.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.11.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 700c49c8-a9fa-49b3-b0b2-ea78459e6fc7.tmp.12.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.11.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.2892568489.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: content_new.js.11.dr, content.js.11.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 700c49c8-a9fa-49b3-b0b2-ea78459e6fc7.tmp.12.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49801 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000FEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_000FEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000FED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_000FED6A

Source: C:\Users\user\Desktop\file.exe

0_2_000FEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000EAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_000EAA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00119576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00119576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1639658821.0000000000142000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_182c5abc-f
Source: file.exe, 00000000.00000000.1639658821.0000000000142000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_75fdb3ca-8
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_93c74b90-2
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_a13bf60f-7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000ED5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_000ED5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_000E1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000EE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_000EE8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F2046	0_2_000F2046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00088060	0_2_00088060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E8298	0_2_000E8298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000BE4FF	0_2_000BE4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B676B	0_2_000B676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00114873	0_2_00114873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000ACAA0	0_2_000ACAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008CAF0	0_2_0008CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0009CC39	0_2_0009CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B6DD9	0_2_000B6DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0009B119	0_2_0009B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000891C0	0_2_000891C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A1394	0_2_000A1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A1706	0_2_000A1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A781B	0_2_000A781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00087920	0_2_00087920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0009997D	0_2_0009997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A19B0	0_2_000A19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A7A4A	0_2_000A7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A1C77	0_2_000A1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A7CA7	0_2_000A7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0010BE44	0_2_0010BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B9EEE	0_2_000B9EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A1F32	0_2_000A1F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 000A0A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0009F9F2 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@96/520@22/15

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F37B5 GetLastError,FormatMessageW,

0_2_000F37B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E10BF AdjustTokenPrivileges,CloseHandle,		0_2_000E10BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_000E16C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_000F51CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0010A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0010A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_000F648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000842A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_000842A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\27c55b01-bc45-4678-94ef-0c952cf24d46.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.11.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 21%
Source: file.exe	Virustotal: Detection: 22%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2072,i,8180152950127741794,4817546992404905651,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2696 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6496 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7228 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7228 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2964 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4372 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6060 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6060 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1228 --field-trial-handle=2108,i,2381369830628417293,13375159391065227036,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2092,i,513492404789473333,1937958185482303577,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1996,i,13354447204659382061,17860069164876913799,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2072,i,8180152950127741794,4817546992404905651,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2696 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6496 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7228 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7228 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2964 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4372 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6060 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6060 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1228 --field-trial-handle=2108,i,2381369830628417293,13375159391065227036,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2092,i,513492404789473333,1937958185482303577,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1996,i,13354447204659382061,17860069164876913799,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000842DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000A0A76 push ecx; ret

0_2_000A0A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0009F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0009F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00111C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00111C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95266

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6428

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\file.exe TID: 6744

Thread sleep time: -64280s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6428 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_000EDBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F68EE FindFirstFileW,FindClose,	0_2_000F68EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_000F698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000ED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_000ED076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000ED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_000ED3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_000F9642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_000F979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_000F9B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_000F5C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000842DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-95384

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000FEAA2 BlockInput,

0_2_000FEAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000B2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000B2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000842DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000A4CE8 mov eax, dword ptr fs:[00000030h]

0_2_000A4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_000E0B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000B2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000A083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A09D5 SetUnhandledExceptionFilter,	0_2_000A09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000A0C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_000E1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_000C2BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000EB226 SendInput,keybd_event,

0_2_000EB226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001022DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_001022DA

Source: C:\Users\user\Desktop\file.exe

0_2_000E0B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_000E1663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000A0698 cpuid

0_2_000A0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_000F8195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000DD27A GetUserNameW,

0_2_000DD27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000BBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_000BBB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000842DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00101204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00101204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00101806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00101806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
file.exe	21%	ReversingLabs
file.exe	23%	Virustotal	Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
s-part-0039.t-0009.t-msedge.net	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://clients2.googleusercontent.com/crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://www.google.com/chrome	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Virustotal		Browse
https://docs.google.com/	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Virustotal		Browse
https://msn.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
s-part-0039.t-0009.t-msedge.net	13.107.246.67	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.185.161	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.11.dr, content.js.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	700c49c8-a9fa-49b3-b0b2-ea78459e6fc7.tmp.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.2892568489.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.80.110	unknown	United States	15169	GOOGLEUS	false
142.251.111.84	unknown	United States	15169	GOOGLEUS	false
13.107.246.67	s-part-0039.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.40.227	unknown	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.219.161.132	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.251.32.100	unknown	United States	15169	GOOGLEUS	false
142.250.185.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.65.206	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501616
Start date and time:	2024-08-30 08:34:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@96/520@22/15
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 42 Number of non-executed functions: 311
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 142.251.168.84, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 142.250.186.131, 142.250.186.67, 2.23.209.155, 2.23.209.149, 2.23.209.154, 2.23.209.156, 2.23.209.150, 2.23.209.147, 2.23.209.143, 2.23.209.142, 2.23.209.157, 142.250.185.206, 199.232.210.172, 192.229.221.95, 142.250.186.42, 142.250.186.138, 142.250.185.170, 142.250.185.74, 142.250.184.234, 172.217.18.106, 142.250.185.106, 172.217.18.10, 142.250.184.202, 142.250.186.170, 172.217.16.202, 142.250.186.106, 216.58.206.42, 216.58.206.74, 142.250.185.138, 142.250.185.202, 142.251.40.131, 142.250.65.163, 142.250.65.227, 142.250.80.67, 142.251.40.195
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-0007.config.skype.com, edgeassetservice.azureedge.net, azureedge-t-prod.trafficmanager.net, busi
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:35:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
07:35:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
07:35:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
07:35:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
13.107.246.67	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	http://1109b4f.wcomhost.com/	Get hash	malicious	Unknown	Browse
	https://uaj.sa/api/aHR0cHM6Ly9nb29nbGUuY29t&sig=ZDUxNjU0ZTllNzZkYTAxNWE4OTNkZTAyM2ZkZDA1MGViMGIzY2UyOTU1MzY1NGMyNjFlOTExM2ZiMzA5MzdmMg&exp=MTcyNDIzOTUzMQ	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://set.page/cdtautomotive/	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	UploadCustomersTemplate(2).xlsm	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://asemailmgmteu.com/api/channels/email/unsubscribe?app_key=UQFtfjD1SJy3G7HKVytUwA&channel_id=hmAq7TweRB-4MzPTFpQTfA&push_id=d85eee10-522d-11ee-99e5-0242ab6c490e&message_type=commercial&campaigns=SME_First_Anniversary_Email_13092023&campaigns=MC&redirect=http://homerunpropertybuyer.com/hhl/ahges/johng@edcodistributing.com	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
s-part-0039.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
	http://1109b4f.wcomhost.com/	Get hash	malicious	Unknown	Browse	13.107.246.67
	https://uaj.sa/api/aHR0cHM6Ly9nb29nbGUuY29t&sig=ZDUxNjU0ZTllNzZkYTAxNWE4OTNkZTAyM2ZkZDA1MGViMGIzY2UyOTU1MzY1NGMyNjFlOTExM2ZiMzA5MzdmMg&exp=MTcyNDIzOTUzMQ	Get hash	malicious	HTMLPhisher	Browse	13.107.246.67
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
	https://set.page/cdtautomotive/	Get hash	malicious	Unknown	Browse	13.107.246.67
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
	UploadCustomersTemplate(2).xlsm	Get hash	malicious	Unknown	Browse	13.107.246.67
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	F.7z	Get hash	malicious	Unknown	Browse	20.71.50.126
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	20.169.237.51
	sora.mips.elf	Get hash	malicious	Mirai	Browse	72.152.158.255
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	20.251.99.83
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	72.153.3.164
	sora.spc.elf	Get hash	malicious	Mirai	Browse	20.213.16.242
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
	https://www.bettercaremarket.com.au/pill-bottle-opener-with-magnifier-aidapt.html?comet_source=google&comet_network=x&comet_campaign=20867905123&comet_ad_group=&comet_ad_id=&comet_keyword=&comet_type=smart&gad_source=1&gclid=EAIaIQobChMIqcj6sY-ZhwMV5tgWBR0YswpVEAQYASABEgJi9fD_BwE	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
AKAMAI-ASN1EU	sora.m68k.elf	Get hash	malicious	Mirai	Browse	23.215.35.34
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.57
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.38
	https://daehwa.info/uploaded/file/71677108868.pdf	Get hash	malicious	PDFPhish	Browse	172.232.31.180
	https://uaj.sa/api/aHR0cHM6Ly9nb29nbGUuY29t&sig=ZDUxNjU0ZTllNzZkYTAxNWE4OTNkZTAyM2ZkZDA1MGViMGIzY2UyOTU1MzY1NGMyNjFlOTExM2ZiMzA5MzdmMg&exp=MTcyNDIzOTUzMQ	Get hash	malicious	HTMLPhisher	Browse	2.16.238.149
	https://hkwyolaw.ency.cloud/	Get hash	malicious	HTMLPhisher	Browse	172.233.123.231
	file.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
	https://cvccworks-my.sharepoint.com/:o:/g/personal/tbrosseau_cvccworks_edu/Eq-UyPVcAplCp0EtULhG-vgBSBG-0YnvqRHIOFaj8gAVeA?e=0GtZle&c=E,1,DChFGbEapD80-9FdFFEzIgnps7b6noVGZQKGJYQxe5NZ1bO4xoHQSXTZoDZYFQom26YXPkpXr4g-Zcy6HwaX1DHyE-5Bk2WBwo9od82Z27DPdBWYzulyG2zvnA,,&typo=1	Get hash	malicious	HTMLPhisher	Browse	2.16.164.49
EDGECASTUS	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://1109b4f.wcomhost.com/	Get hash	malicious	Unknown	Browse	152.199.21.175
	http://l9sa.github.io/	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://uaj.sa/api/aHR0cHM6Ly9nb29nbGUuY29t&sig=ZDUxNjU0ZTllNzZkYTAxNWE4OTNkZTAyM2ZkZDA1MGViMGIzY2UyOTU1MzY1NGMyNjFlOTExM2ZiMzA5MzdmMg&exp=MTcyNDIzOTUzMQ	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://5kirp.mellifluous5.com/5kiRp/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.141
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://cvccworks-my.sharepoint.com/:o:/g/personal/tbrosseau_cvccworks_edu/Eq-UyPVcAplCp0EtULhG-vgBSBG-0YnvqRHIOFaj8gAVeA?e=0GtZle&c=E,1,DChFGbEapD80-9FdFFEzIgnps7b6noVGZQKGJYQxe5NZ1bO4xoHQSXTZoDZYFQom26YXPkpXr4g-Zcy6HwaX1DHyE-5Bk2WBwo9od82Z27DPdBWYzulyG2zvnA,,&typo=1	Get hash	malicious	HTMLPhisher	Browse	152.199.19.160
MICROSOFT-CORP-MSN-AS-BLOCKUS	F.7z	Get hash	malicious	Unknown	Browse	20.71.50.126
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	20.169.237.51
	sora.mips.elf	Get hash	malicious	Mirai	Browse	72.152.158.255
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	20.251.99.83
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	72.153.3.164
	sora.spc.elf	Get hash	malicious	Mirai	Browse	20.213.16.242
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
	https://www.bettercaremarket.com.au/pill-bottle-opener-with-magnifier-aidapt.html?comet_source=google&comet_network=x&comet_campaign=20867905123&comet_ad_group=&comet_ad_id=&comet_keyword=&comet_type=smart&gad_source=1&gclid=EAIaIQobChMIqcj6sY-ZhwMV5tgWBR0YswpVEAQYASABEgJi9fD_BwE	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://netflix.netfilm.online/i/df117e8a574734eac962e44d96d884ee9?fp=a8b756deca	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://eu-central-1.protection.sophos.com/?d=manychat.com&u=aHR0cHM6Ly9teS5tYW55Y2hhdC5jb20vcj9hY3Q9YjFkMWQwZDkyMDBkMzg2OGQxODUzY2NhYTk0Y2MxYmQmdT03ODg3NjgyNjIxMzQyNDMwJnA9MTAzMTAzNDUyNjg5OTI1Jmg9YTM4ZGRlMzNiMCZmYmNsaWQ9SXdaWGgwYmdOaFpXMENNVEFBQVIyNTVGWGl1MGk2VnFpR29zYktwampSVVgxQllIR2VXMjIzY0VsdzhQV1JxQkljdzFwOEtxQ3QydHNfYWVtX3djeUE3ZklHUmc5anZ3elZEVUZnc1E=&p=m&i=NjM1OGY5Yjk1Yzc0NzYwZmVkZjg4ODBh&t=UnJja2pSclhrTCtBamxpVW5SbExkeEY5Y3JMRXJReFA1MHNjMk83N01UTT0=&h=ac3121ecdd334a8eb27b9efa20223e6a&s=AVNPUEhUT0NFTkNSWVBUSVYt5nkMY7lrXten-tMtQEoHjKHanPDgFGYEyZWMpkBETxK29AsSDujuoNOgxyOGay3pj-cHDVi7N9Bi-dbvWmnMoslvZEuKFbMo_q4CIRO7yQ	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://www.bettercaremarket.com.au/pill-bottle-opener-with-magnifier-aidapt.html?comet_source=google&comet_network=x&comet_campaign=20867905123&comet_ad_group=&comet_ad_id=&comet_keyword=&comet_type=smart&gad_source=1&gclid=EAIaIQobChMIqcj6sY-ZhwMV5tgWBR0YswpVEAQYASABEgJi9fD_BwE	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://www.dropbox.com/scl/fi/op070xas0eh2p222upauu/Document-1.docx?rlkey=lrjcxds4fso3d5dmmlv1itair&st=c1fl3n2k&dl=0	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	9XY1WXZSqQ	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.065736859176163
Encrypted:	false
SSDEEP:	384:rtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS/liTYXW1Dxoxj1KgzFsGCxq5z:BMGQ7FCYXGIgtDAWtJ4nc8XW1Mj11Bs4
MD5:	5EE3B4ACBED8C7E7110758277A72F995
SHA1:	45DA8F7169FF89CCE27976C56AB33446F2D398E7
SHA-256:	8C0ACEE5CE6FE529BBD19A02DA9EB36371C983FC2D188579E64950E97B2B940B
SHA-512:	5CAF52AA9D248E7DA9C2EAE3221564B3E85DADB3D13B73AF2F2185F8932271718E902C1C593C0C5DFE11261D4BA0A2A9525376592341E0D938ED11A21E0086A3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369473297510885","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2d34c4f9-998d-4f47-a31c-2157442a7ad0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20969
Entropy (8bit):	6.065771302998488
Encrypted:	false
SSDEEP:	384:rtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS/li5YXW1Dxoxj1KgzFsGCxq5z:BMGQ7FCYXGIgtDAWtJ4nciXW1Mj11Bs4
MD5:	5CFEC41A81BFA9E4FFAA94F9E8559AA1
SHA1:	DCEA7C9A634CE31121406B1AF960763F65213FB0
SHA-256:	0FBCB25021D3E90241D1A800EA60869A33B150BCB03D8B22C83164C64E33B9B8
SHA-512:	26DCB7D81DF855E489B286D01458323E49C1569CC0381A1E58A0030924DFA61F4BC87FADCF7C3A0FFEFE1307C3A9F2428ECBC14D06E9403C61286E7DFD667C88
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369473297510885","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7614c980-b8bc-4d31-a0fa-e71624fe10d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.496419411262614
Encrypted:	false
SSDEEP:	96:0q8NkGS1flUli258rh/cI9URoDotoJ9B0Pvgi0zJk1ccHSDS4S4SDSeqI4a:/8NBSvUliHeoDUeY0Fk1Dxv
MD5:	779569C3D84A68187AC29045F5BE639C
SHA1:	DE0D328303727C63E804D11687A607D61DF3E9D6
SHA-256:	A4CD9169CEFAE7BEB5C81927E0F8E3F4D3EF2C47A596AF777DCDCAD00638DB2F
SHA-512:	02C4D2B8AFDB4CA3A17127A58CA66DDA5B40F46975EDDED81542C9AAEFB269F36A128DE0BDEA426D60A467D916E0741D69968038F17580E2F429F9201F2467A8
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7695edec-25f4-4204-89f2-6de617bd107c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.609240426119789
Encrypted:	false
SSDEEP:	96:0q8NkC1flUli2cHB0Pvgi0zJk1ccHSDS4S4SDSeqI4a:/8NbvUlipY0Fk1Dxv
MD5:	BC9A5C2347F9E056B6A138F78DC9B913
SHA1:	AB9F62E39B46285B173BF439BF82F2167D0118BC
SHA-256:	C9F4618E872C2285AC42540E2841E78C0C768F16FEB571BBA269A53A18CFFF3D
SHA-512:	3FFF991210C9438871E810E3D5D335A148D0FC4026B1D547D6D6B1AF759A191BCB9AEDD5DBCB5F26732412AA1313DC6BCC6177EDF10B838FD3CFB5AB8122AB04
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7a1c9612-978c-4d96-bc1c-44face983a86.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20969
Entropy (8bit):	6.0657638339462645
Encrypted:	false
SSDEEP:	384:rtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS/lilYXW1Dxoxj1KgzFsGCxq5z:BMGQ7FCYXGIgtDAWtJ4ncWXW1Mj11Bs4
MD5:	43EA885EBB5DCB1C2B469B54E0AA56F7
SHA1:	64102311F9E52DA972C6B71CF74D8843E0C9EEE3
SHA-256:	B95C4DEA6B6B836EE2F73D0F2F0EA5D0BA605BE1D0943214CEDEBE5ECC0D1798
SHA-512:	A9ECF819F1683EBA4EFAA7C1220F4217DF3A21EB707351BCF9EB8858D6EF1206A95E92604F0E7792C7CACC820B03C8B0AFB12B3BC5EAA674CBB4F9FADB009B11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369473297510885","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\982be20e-40e6-435b-8c5d-df1d848871a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71486
Entropy (8bit):	6.072594537401475
Encrypted:	false
SSDEEP:	1536:BMGQ5XMBGzyiWgD5uc+PajmJQx1ehTM3VZ3SaZcm/ebKdwJ9ThsMe+zUUTcrBshm:BMrJM8zyiEFPajVtVhSamBbjtu+zUUTc
MD5:	16A890AA04CEAE61D6CE190969D49894
SHA1:	A6C036F91EB50F5B25CC23B401A7A58C6A85AC6F
SHA-256:	D863BF98D3E4FA762B3E3BC90B3D40A54D6133903FBCEB262FB344A5311FF1E0
SHA-512:	5BC38E4FB3AF34CC80B4C941FC4BDF769D59C9FE565F300ACBF3F005F82A15CBE1496790DFFEDCCD7BC93E1FD55759B25750A852E2776EFBBCED85BA4A0F3252
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369473297510885","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\9e7a87d0-d098-4094-9e27-ea55a8b7e9b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24300
Entropy (8bit):	6.053802721941851
Encrypted:	false
SSDEEP:	384:rtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8Nl/li5YGGwqdqVE+z69XUTexj1KgzFsGj:BMGQ7FCYXGIgtDAWtJ4nziGGf+z69XUA
MD5:	4C19222811714DB79F75BB46CAC6DC8C
SHA1:	899383EEC5B1C90F5DB13CC57F187F15FE23575B
SHA-256:	111CA276C995D23D638261598775FAF1B74B9E5D568D23506FEB2D9C8F603015
SHA-512:	416599D170D783E3AA696743583509D4FDBB27F43561540EEC52AAB31F6CB789EC0BC396E8FC4D201C5605A56151F1385BD7D06F013074007A2182A3E87E1863
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369473297510885","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\a2d2b249-a8ae-4cea-919e-9f1ea42a8793.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D1680E-1AA0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0401756954083818
Encrypted:	false
SSDEEP:	192:MmgUjLYiVWK+ggCNG2JZzKFd9XTYFPgYUc58h6fNEihcRQ8NMyan8y08Tcm2RGOD:PgUjjl5MJ1hwTQqya08T2RGOD
MD5:	A0592707D2902E1476B3F7BFF316276A
SHA1:	7D4028FE28E81F082B4DD3B50652F5EEE24D88FD
SHA-256:	0212D7E799514157C47E50AFC3497294A3E6F1C86AE7C073698451C5DFB86BE1
SHA-512:	744D7255E143F07CCA806E0A9557A9E7AA40FC8449B4B1C808AE87D571791BFCC7DB836EA81A05952E603B52DDBF1A1571F9C67F375E280EAF810B5217512BCE
Malicious:	false
Preview:	...@..@...@.....C.].....@................`..8P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".jsevgx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................>..$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-...Q@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D1680F-1520.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset -144115188075855872.000000, slope 68694245376.000000
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.458622952142744
Encrypted:	false
SSDEEP:	3072:OUK2wnfKCk7j5qehMKdekZ9Pi145hmcfYAK9L3CXtSg1HFPtiPsMVJa1B2qjuVev:nQI7s7CXtSaHCpfNGYeaH4nF8E
MD5:	55D95311E0385873C598D7F864699D95
SHA1:	5C632F6D8C7AD2AC22AE2249E588567E0BA04E64
SHA-256:	81CAE8E656EA0A0EBE41D64D9934CF1442841DF037B5F98E37EB3DA4540291BE
SHA-512:	D62036C83D2D861789F29C1FFFA32961E0F08338DA5B4881C3705FD9226BBB993CF2A1CB710DC12DE0D9224D4C62D7A0A1F4C18FB46E78CA034A4C7A3E89F2D2
Malicious:	false
Preview:	...@..@...@.....C.].....@............... K...J..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".jsevgx20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.141765541632406
Encrypted:	false
SSDEEP:	3:FiWWltlWbujvm4HSRqOFhJXI2EyBl+BVP/Sh/JzvbR/zsg9hIknmkXl:o1Wbuj/yRqsx+BVsJD1/zsij5
MD5:	B2622FED212E4A41A2D53E630F879DD2
SHA1:	C714DE961BDB97FB2E5BE46AF983A406A843E509
SHA-256:	CC950B2C9F609A7E6D724B6B1B2D5464B5CB13E2070DD615A8B71ED82691A68E
SHA-512:	606ED071D1E9AD1DA3D02B00D0DE5DBC8792C413F4DA9C618FD2AA928EBB2493FDEED8514CE2DA0684EFC30AFB4969B8FC9BC0BF249D71EF3749064C18A95199
Malicious:	false
Preview:	sdPC........................cM@....opP."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................5e4b8891-e0c4-4b8b-aa1b-0915cf69c5bc............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0594febd-14c1-41d4-8e35-c3664fcfb41c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3d2402c2-b979-46b4-9408-0bd2c5111e8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.976638764634893
Encrypted:	false
SSDEEP:	96:styqf9is1x9b9ib/zN8z0s85eh6Cb7/x+6MhmuecmAehnQa2Mi/EJ:styXs4rNk0s88bV+FiAyPiMJ
MD5:	A75CA93621B4559E941E4006F4B4CC46
SHA1:	FF9788C1F9F11C8B2C34202381A77F616D567B38
SHA-256:	9B908FAC6E5393BF3220F28D708EC336494D9D601A3880F298C95C27C894A60D
SHA-512:	79C52168FD11FF73D571397CA120D754A98AEF264130D0AE5C65238957D6A0051C7D99445EB2C39372D741B07CBD4D0E5DCBAABFF94CE9EC1217FEDB1E157767
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369473297212539","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369473297463527"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\44cceb5f-2947-48f2-b213-473610770b7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566088897799829
Encrypted:	false
SSDEEP:	768:JVt+M3WPr/foH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ4DxTrwl2zpGtuY:JVt+M3WPr/foHu1jaQUxol2EtL
MD5:	BD59A40295C6C400EBDCCFE3669A3592
SHA1:	774DC2BA40E029AC36D31D4AD6A64C2702AF2CE4
SHA-256:	148E9A989559AF451911DBFEC25008313D168F8C951EBEF8D4734CA63304539B
SHA-512:	B6EEE793BFF8AFDB5327C9F334BAD790D3719523F55A952A1DEC98ADB339B8F02F8FEE2CEDA72015277B472AD2ACB1E693CEE21387281E6337B62F38103497A5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369473295443595","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369473295443595","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7c10502c-aa37-4297-81f3-e9905fe78d6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.969627466303438
Encrypted:	false
SSDEEP:	96:styqf9is1x9b9ib/zN8z0s85eh6Cb7/x+6MhmuecmAehOf2Mi/EJ:styXs4rNk0s88bV+FiA/PiMJ
MD5:	3ED335B425D86E78975B0C029E24ABB7
SHA1:	0FC12FAAC04873973BB70882F119F68B859830A5
SHA-256:	A2A2237487202B1399F8686A38BC68CF6E6960E692AFB3739DDE69CD6C9CE7A8
SHA-512:	DEEC88A2990095935E1854221D9D1C2ECEDAA7625D4567ACC6261CEAFCCF830FC538F0956C6C3B38D4864102BE73A9DD39378AA40912A8127D84BAFD2B24DEE5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369473297212539","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369473297463527"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7d03b927-a45b-4a52-b45e-5615986fc233.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.3208991912185395
Encrypted:	false
SSDEEP:	192:WAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:JOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	EDFB0098C145B9BC6A1EC7D4A127F32B
SHA1:	FE2CE103B0096C4E55D3C14E6F36E5426D756303
SHA-256:	6B1CD1594AC6F65A5032CE0C84651B2ECD2B286EBA744AFC676F35F2DA7FF11E
SHA-512:	B16C3458F749B20D19AFFBF5BFDED88CC518B1CB5CBA228B53B8C8CF7F38CBA6CD85B4D33709A71BC3E020B7E6D6361D40EBAFD94D1143657F6D8B0010D5118C
Malicious:	false
Preview:	...m.................DB_VERSION.1.8.f.................QUERY_TIMESTAMP:arbitration_priority_list4...13369473301733600.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.093655769240109
Encrypted:	false
SSDEEP:	6:JVMU1wkn23oH+TcwtOEh1ZB2KLlTmEqq2Pwkn23oH+TcwtOEh1tIFUv:bMDfYebOEh1ZFLSvYfYebOEh16FUv
MD5:	55CAEE81D0FBB7595231A1BD562FAE35
SHA1:	0E50EFEF01D7600F2CC1A845BB9717A7FD83CDEE
SHA-256:	A362B1ACEAA7F37C46053A70871A17BD7AD340EEDF2405B061CF777CC2B54A5C
SHA-512:	7A354109BF41D491F611DBA7842BB02E0C56DD0BF7F34C7CA4AB06650976B8C08A3C7093CE4E0CAEFF2801D83AF7E84D8BF9994E29CE045BEF2417D39BAC8D25
Malicious:	false
Preview:	2024/08/30-02:35:00.943 2130 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/30-02:35:01.021 2130 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.044253187495337125
Encrypted:	false
SSDEEP:	6:/Fii26KB8kM/lJZSe/Ks8lrtYaSaTltbc0foF//ly:dQDEiGKs8lZlH81y
MD5:	A5E76148A8287FD931C78ACF30A38F30
SHA1:	197562B7388CF82C15C57026B879AF0E249DDA35
SHA-256:	73BF33C0ED359B42861B5E5ED99C93DD22D705AD5981E12B2E9417735ACB1C3E
SHA-512:	590BDAEB5AA4A92C80DA65EEFC59F8305EC2747832D4D581FAE6DA46EEBADB2643D05F0384B8E421C5680CBD91074AB7C0E200D2F67CF194361C98FACCCEBEF7
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09579293624028527
Encrypted:	false
SSDEEP:	24:er7+V4XQ3eaPVH54+QV4XeaPVHaUAPnQzLIoMQDQzpolMYT38EWp469HVIRBNUeK:FV4A3esUV4XesrAQiqT3lWp4rNUeGs0
MD5:	ED5AD28D2C9BAAAA033C2D3254508453
SHA1:	3E0A86E045D9BB910A5B47BB1447F6C8A3811C95
SHA-256:	B2D2BBFC1FA1417B490B53C0EB556CC2E00F0272AAC20FF80EE186A699E05A75
SHA-512:	8A511AC9F1855803D6E6EED3101FB82417DE9B0ED8B7D43465FF397C073048C5E64E60E59667A251224136749CD0F6CA84C6241E7020C51EB64C047C48C1B1DA
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.28356859356526043
Encrypted:	false
SSDEEP:	384:iVTbhJtMiAVTbhJtMw4DbdnbKJtyXqm3HnJtpbz3HnJtp:iRbhJtmRbhJtQbdbKJtOHnJtlHnJt
MD5:	43D807CF787D5750829E80196D5D18A1
SHA1:	D95EC453AECF5E06087D799451EA3644B18D1CEE
SHA-256:	D2E0492D63283F297C0C04866F9C8111B94EEDDF8A8DEDC1B4B6A6BDE8908E9A
SHA-512:	EB3569F2B3EDB62537E726AC24FFEE5263D26A2E23CFC2D436E74585E4846AA329D6D9475725452BE105BF95C05C444C29C3C9388A09649BF4B688A605CC0D96
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulJ+:Ls0
MD5:	4420CE781EBC3A0A8FBB90C54DADAE2F
SHA1:	96ECAC8FB7865ADFF9776F2A4288358E4B842B23
SHA-256:	532AA426299B6DBB74DACAAD0CF20F6864387F118D41D0E3F0A469081F6F1D92
SHA-512:	EC71920DAC859FAACE5ADEE2AD60A50D68BBD9BD7C6F183EAF0219FA9C1443768F89A276099329C3BEBD6E051F5EEE76E49156F813607E4598A00BD50CA81553
Malicious:	false
Preview:	.........................................K..w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:YyXKcyyEJ543Sa+:Y6KP9JmiT
MD5:	DB7D648BC628CA74736E49952E105661
SHA1:	60089B43A9850298F72CF74BFA94B84A10C654CF
SHA-256:	968602CBFD18FAE6A5C9D74430301FCA38A46A4420FD1565F085E79B01C32EFD
SHA-512:	F5884211F2030B7A1C1CCAA3D0CD7622F0E69B74FE4A3E42A967F4D0CB5C57C6830F104B1A347ECA8BB274B2344D011F04C7596A2880E56081D2E83451D4E1A0
Malicious:	false
Preview:	(......oy retne............................w./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:YyXKcyyEJ543Sa+:Y6KP9JmiT
MD5:	DB7D648BC628CA74736E49952E105661
SHA1:	60089B43A9850298F72CF74BFA94B84A10C654CF
SHA-256:	968602CBFD18FAE6A5C9D74430301FCA38A46A4420FD1565F085E79B01C32EFD
SHA-512:	F5884211F2030B7A1C1CCAA3D0CD7622F0E69B74FE4A3E42A967F4D0CB5C57C6830F104B1A347ECA8BB274B2344D011F04C7596A2880E56081D2E83451D4E1A0
Malicious:	false
Preview:	(......oy retne............................w./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:YyXKcyyEJ543Sa+:Y6KP9JmiT
MD5:	DB7D648BC628CA74736E49952E105661
SHA1:	60089B43A9850298F72CF74BFA94B84A10C654CF
SHA-256:	968602CBFD18FAE6A5C9D74430301FCA38A46A4420FD1565F085E79B01C32EFD
SHA-512:	F5884211F2030B7A1C1CCAA3D0CD7622F0E69B74FE4A3E42A967F4D0CB5C57C6830F104B1A347ECA8BB274B2344D011F04C7596A2880E56081D2E83451D4E1A0
Malicious:	false
Preview:	(......oy retne............................w./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:YyXKcyyEJ543Sa+:Y6KP9JmiT
MD5:	DB7D648BC628CA74736E49952E105661
SHA1:	60089B43A9850298F72CF74BFA94B84A10C654CF
SHA-256:	968602CBFD18FAE6A5C9D74430301FCA38A46A4420FD1565F085E79B01C32EFD
SHA-512:	F5884211F2030B7A1C1CCAA3D0CD7622F0E69B74FE4A3E42A967F4D0CB5C57C6830F104B1A347ECA8BB274B2344D011F04C7596A2880E56081D2E83451D4E1A0
Malicious:	false
Preview:	(......oy retne............................w./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlfd/:Ls39
MD5:	708284F77A7AFE6F64CDF29A0FA4DBAC
SHA1:	2F56B3564CA7955A82D0E52678CDFBD4287D79B9
SHA-256:	765C420B009B5E5E0567F9B943D615D2178563695BEF1AF5E6B19F19458B312E
SHA-512:	45953946B0C101023014C8E047C0472C07EF5048BC04882EFE77FAA0E9F4F8627C2EB9DCEF36C521AEA8991366E7DBB2DF3AB93ADE0DB595703775A4138FABAB
Malicious:	false
Preview:	........................................N...w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354120085276807
Encrypted:	false
SSDEEP:	6144:4A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:4FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	AED5FE861DE18BD25C82049E5C54C384
SHA1:	2B01D10D3932A82E17A92BBAB83BBBC461748AA9
SHA-256:	6092F0FF36BAEDFA6088BADFF821B31197CBD6EEE63E47C7E88C512ADE85822C
SHA-512:	B6E6051CD5295279ACD97E81F380BAA6A0756C6F5DD0EA4F8FA7DEC31295AA8DD679846EBAA7C114FE8631A902CCD8353A91DDE42C3FAC88C451B18B99DAB64A
Malicious:	false
Preview:	...m.................DB_VERSION.1..:.q...............&QUERY_TIMESTAMP:domains_config_gz2...13369473302145078..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.213325606759851
Encrypted:	false
SSDEEP:	6:JVOYB1wkn23oH+Tcwtj2WwnvB2KLlTm0Q+q2Pwkn23oH+Tcwtj2WwnvIFUv:blkfYebjxwnvFLc+vYfYebjxwnQFUv
MD5:	B51AE8908668DF5AD0A8AE35857A9D62
SHA1:	370C576DFF4E78830A793D2A4DFE4EDEA0F4468E
SHA-256:	348064F3571DEE9679D94D84179FA36F4089C591DFA463FA18E345E49BECADB4
SHA-512:	49384C0E2E9A5C3286142D1EF227C65D44ABD0058F35F797DE485F57051B57D4244E8341EB862FC92DE7009CE0929A64A8016E8E8E1B83C0DBE8E21F28766AD4
Malicious:	false
Preview:	2024/08/30-02:35:00.969 214c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/30-02:35:01.057 214c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324617189025091
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R0:C1gAg1zfvM
MD5:	50E7E0D16AE1FC1F5E87A8DD57EF6088
SHA1:	E70547D94A3C5676D84B7015961C7981E4A7C981
SHA-256:	D7D381F524A5B15449301DF3A7E5DF966C9B1B05208B8C1D70932F1E6404D4D8
SHA-512:	B6C2D08223E6B78D5C71220AE0BCE954928503B566F69BB7CC8397EF3220D6866AB3DF497AFCF4181B6F8FD8524ACAC3F2A0B334C01D9D1753E32DF180C11192
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.190845889322224
Encrypted:	false
SSDEEP:	6:UCERM1wkn23oH+TcwttaVdg2KLl2tFq2Pwkn23oH+TcwttaPrqIFUv:UHRrfYebDL4tFvYfYeb83FUv
MD5:	A5C6E933413F328B022A9E59E1DCDB30
SHA1:	98377FD0C4EDBAC59F492EE726B10955273535E6
SHA-256:	0B1844A7B61422A4F790F907D6D944D4AF983233CE8F3F76E2079F705FD861E5
SHA-512:	F59B6AD364C08E52B93631C8E1414AF3481465B4F5C868EA1D01A1B0A81CA2196060E119EC2C0121E878B26B52ED8751F757B5A43CF46660511487783C6DAC8E
Malicious:	false
Preview:	2024/08/30-02:34:55.441 1c24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/30-02:34:55.849 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.204856208969713
Encrypted:	false
SSDEEP:	6:PERM1wkn23oH+Tcwtt6FB2KLlvZMq2Pwkn23oH+Tcwtt65IFUv:8RrfYeb8FFL92vYfYeb8WFUv
MD5:	8B3236FBD8B822D3C17FBA65048E350B
SHA1:	8A4873CE5BFFA2FE464272E53FEF76954C3BD066
SHA-256:	C16F14B4CBB0EA699EB094794EAE4ACD35878689E9AD3009B847481EC3EB834B
SHA-512:	B8A0E59F23D59ADAAA183C8D078800BE703DAFFEDC60DDC55E4385F0719565BCF00FA3736AED8525420F725AF6FB1F607769E8D28C4F34C0E98FFCF315391DBB
Malicious:	false
Preview:	2024/08/30-02:34:55.951 1c24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/30-02:34:55.966 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.171057505724324
Encrypted:	false
SSDEEP:	6:w5uCRF+RM1wkn23oH+TcwttYg2KLlKFFzOq2Pwkn23oH+TcwttNIFUv:Wbj+RrfYebJLe1OvYfYeb0FUv
MD5:	68D9DC4A8F3CFC351B9A3999A7A3D2E6
SHA1:	BD5A344576A1102B997C275015B8C80124358ABF
SHA-256:	B59E6BC8B3F7588BBD55E2AE76619872DF06669ADDC463888C6D78C36BDA2393
SHA-512:	2A0652A88B922E28D882D80611A9E17D6057FB2F7387FC67FAFA13B0AA8F2A901ACB10C1DE921CF6CCD5881DE579DC2DFB76625A05C01BD5ED8475563F42439F
Malicious:	false
Preview:	2024/08/30-02:34:57.606 1c04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/30-02:34:57.620 1c04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlm3Sp:Ls3m3Sp
MD5:	A19926E1280548C9FB4E49C6509F0222
SHA1:	48E0F727664CFEACDB700D09BCCB9174334792A5
SHA-256:	6584DEA2A5E64953DEB6034E55E59098A0B3CF8447BB7B06E0D9B65267DDE41C
SHA-512:	75A90C8A0A743920FB409B77BBE54DF115694EA2175220A03350EAF29E5067CE67D795BF07C83E9468E261792CE575474C478D7693A387CBBB6F871176CEA92B
Malicious:	false
Preview:	........................................"V..w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21848828281205318
Encrypted:	false
SSDEEP:	3:fqD/ntFlljq7A/mhWJFuQ3yy7IOWUTitn4/dweytllrE9SFcTp4AGbNCV9RUIdn:fB75fOwm/d0Xi99pEYLn
MD5:	F51E824BA3B661CD8A5F153545ABFA3D
SHA1:	C1E539F7DEDE6CD77051915CDAA8ACCD4B90FFF7
SHA-256:	C663CEE6E00097C108A163427C020A784B89B2ED51E433F6DB395AC2F3D5CA70
SHA-512:	49DB5373F1FC1C993D372BEA170B0B6E12DEA802D27563AC277868FFD5FAA302B538F6B677874C0FD950A9718C57A8523BC34C8423C94AF4FDE0411B64001658
Malicious:	false
Preview:	............K......&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.251711877739344
Encrypted:	false
SSDEEP:	6:ccJ1wkn23oH+TcwtRage8Y55HEZzXELIx2KLl+XT7WM+q2Pwkn23oH+TcwtRages:KfYebRrcHEZrEkVLg7L+vYfYebRrcHEz
MD5:	17000392C64F743B3DF7FF4E385BB1F4
SHA1:	B1A0EC51BCCFB2C4957560010A0ABF9117EA6A71
SHA-256:	939AD3589D6DA4AC0BA8E48856F70684CC73B711DA08A09F9E1077ED8D825949
SHA-512:	BAA59FFD92641916CD9D9075263A7C1CF944A9FC33B22301E4B1DE5F5E4021AE709C214D68A18D25DF2428B2000BFD3D8F63FA0AB271B4D74AD3377E95A8F858
Malicious:	false
Preview:	2024/08/30-02:34:58.571 161c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/30-02:34:58.583 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.20426010718598
Encrypted:	false
SSDEEP:	6:3uq1wkn23oH+TcwtRa2jM8B2KLlNKq2Pwkn23oH+TcwtRa2jMGIFUv:e1fYebRjFLKvYfYebREFUv
MD5:	1EC46DBA4C3822F1065A377E126D3949
SHA1:	BEF992461D707ED7ABEE729D064C26BA1C911F1C
SHA-256:	8389C54152E9AC24B82CB73F01F98F5A28702B1C6EC1139A3570FDF289160235
SHA-512:	E4EB758EA17D8A7362A6C8761D4FDCB0CD232C52F99B8137F5851FCCC3AAD00372313C359E090092AC8B714D255E400E31E4C6284EF13992442D53729971D56A
Malicious:	false
Preview:	2024/08/30-02:34:56.084 1cd0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/30-02:34:56.118 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\2f2912e7-e3f7-4160-bb76-b0e1a6af91cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\3d82ceb0-530e-4ca5-aaa3-d69107390efc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbRHeHBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ubIa4MS7PMVKJTnMRK3VY
MD5:	633DDD1B4920EC5BE074DBE9C025C0CA
SHA1:	544DEC5ED8BD3FBAB234940BEA45390B5CEF13D1
SHA-256:	8FCAE56F81D49DE83AC45BB8848E818C99462EEE03D017124E895D39630B3889
SHA-512:	CB89ABA6C2D59A7D520BD1BBDB85CBDF5CFBBE3DC9DFD02E06071F8597E3EB0D3B3BE3587AE58870B92127379A2C875A856F11B6792D4A68C5204837814549A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\73f8717e-2364-47dc-b440-3d96d758f80e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\97e59acf-e470-45c1-80d6-6fec8e6c4a22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3adf4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7611339761095878
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkwK:uIEumQv8m1ccnvS6K
MD5:	80898980DADA3D7504F0C0D33BA1F590
SHA1:	FC8EB405D8355E183CE05A18DC4AAB6B188EAAC4
SHA-256:	20E44099B69A9FADE4CA772D0C718878F460C739CE0DE4A7AEDE63270FEC7418
SHA-512:	3310DB29FEA8C60E9CD99F552DE9B79D6AF349CB90B0479C88E7FE4B704D8793E6BA55F0064094B7CBF6759BA3A453C835EB1BA99C67F5B8EB52E317D58A59E1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF29159.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\b22f4bcb-10d1-4ac1-8d7b-4ccaa94c245e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.969627466303438
Encrypted:	false
SSDEEP:	96:styqf9is1x9b9ib/zN8z0s85eh6Cb7/x+6MhmuecmAehOf2Mi/EJ:styXs4rNk0s88bV+FiA/PiMJ
MD5:	3ED335B425D86E78975B0C029E24ABB7
SHA1:	0FC12FAAC04873973BB70882F119F68B859830A5
SHA-256:	A2A2237487202B1399F8686A38BC68CF6E6960E692AFB3739DDE69CD6C9CE7A8
SHA-512:	DEEC88A2990095935E1854221D9D1C2ECEDAA7625D4567ACC6261CEAFCCF830FC538F0956C6C3B38D4864102BE73A9DD39378AA40912A8127D84BAFD2B24DEE5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369473297212539","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369473297463527"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3205a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.969627466303438
Encrypted:	false
SSDEEP:	96:styqf9is1x9b9ib/zN8z0s85eh6Cb7/x+6MhmuecmAehOf2Mi/EJ:styXs4rNk0s88bV+FiA/PiMJ
MD5:	3ED335B425D86E78975B0C029E24ABB7
SHA1:	0FC12FAAC04873973BB70882F119F68B859830A5
SHA-256:	A2A2237487202B1399F8686A38BC68CF6E6960E692AFB3739DDE69CD6C9CE7A8
SHA-512:	DEEC88A2990095935E1854221D9D1C2ECEDAA7625D4567ACC6261CEAFCCF830FC538F0956C6C3B38D4864102BE73A9DD39378AA40912A8127D84BAFD2B24DEE5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369473297212539","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369473297463527"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3958a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.969627466303438
Encrypted:	false
SSDEEP:	96:styqf9is1x9b9ib/zN8z0s85eh6Cb7/x+6MhmuecmAehOf2Mi/EJ:styXs4rNk0s88bV+FiA/PiMJ
MD5:	3ED335B425D86E78975B0C029E24ABB7
SHA1:	0FC12FAAC04873973BB70882F119F68B859830A5
SHA-256:	A2A2237487202B1399F8686A38BC68CF6E6960E692AFB3739DDE69CD6C9CE7A8
SHA-512:	DEEC88A2990095935E1854221D9D1C2ECEDAA7625D4567ACC6261CEAFCCF830FC538F0956C6C3B38D4864102BE73A9DD39378AA40912A8127D84BAFD2B24DEE5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369473297212539","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369473297463527"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566088897799829
Encrypted:	false
SSDEEP:	768:JVt+M3WPr/foH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ4DxTrwl2zpGtuY:JVt+M3WPr/foHu1jaQUxol2EtL
MD5:	BD59A40295C6C400EBDCCFE3669A3592
SHA1:	774DC2BA40E029AC36D31D4AD6A64C2702AF2CE4
SHA-256:	148E9A989559AF451911DBFEC25008313D168F8C951EBEF8D4734CA63304539B
SHA-512:	B6EEE793BFF8AFDB5327C9F334BAD790D3719523F55A952A1DEC98ADB339B8F02F8FEE2CEDA72015277B472AD2ACB1E693CEE21387281E6337B62F38103497A5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369473295443595","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369473295443595","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2f13c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566088897799829
Encrypted:	false
SSDEEP:	768:JVt+M3WPr/foH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ4DxTrwl2zpGtuY:JVt+M3WPr/foHu1jaQUxol2EtL
MD5:	BD59A40295C6C400EBDCCFE3669A3592
SHA1:	774DC2BA40E029AC36D31D4AD6A64C2702AF2CE4
SHA-256:	148E9A989559AF451911DBFEC25008313D168F8C951EBEF8D4734CA63304539B
SHA-512:	B6EEE793BFF8AFDB5327C9F334BAD790D3719523F55A952A1DEC98ADB339B8F02F8FEE2CEDA72015277B472AD2ACB1E693CEE21387281E6337B62F38103497A5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369473295443595","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369473295443595","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.128772436481684
Encrypted:	false
SSDEEP:	6:mt0q1wkn23oH+TcwtSQM72KLlDU2Iq2Pwkn23oH+TcwtSQMxIFUv:mt01fYeb0L1ivYfYebrFUv
MD5:	E000BA12EE79C2549882F30014FBB81F
SHA1:	9C4F5828F6D5DEC783D9B92B962B12F294FEF19A
SHA-256:	8CCE75A761F171A19652568679FA4BE4B715CAB06AA51EC8BDFA2B7BD13A8797
SHA-512:	7888270D5EAB312B02159D2DC0752B92B6B048544C526FA87111832F9C9000A28CD92CA7A8BA5F904947831213663F02CD8C0BC1074A0A7D14F321F6DE1546E3
Malicious:	false
Preview:	2024/08/30-02:35:13.308 1cd0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/30-02:35:13.327 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.116076019551264
Encrypted:	false
SSDEEP:	6:YH1wkn23oH+TcwtgUh2gr52KLlJIq2Pwkn23oH+TcwtgUh2ghZIFUv:YGfYeb3hHJLLIvYfYeb3hHh2FUv
MD5:	B4E0FA9F6804F5B7210DDC5BA351FE81
SHA1:	3B65BC3AB945BE04EA147A36D9D7C938240027CF
SHA-256:	229923538C991BE6D54D6B557CD87F6CEADF177D6F8C30E68F40934319D12B74
SHA-512:	B936E51D9DC7E00192CC6746866916CAF191A0BAB8B8394C788CC3BA32E410E15DEA65A22853173F59C21792934A3EE9C65D57F6BB8E452FC67E688579762403
Malicious:	false
Preview:	2024/08/30-02:34:55.483 1c10 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/30-02:34:55.495 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul0a+:LsnT
MD5:	526C9220DFEDCE40517E3281B882EAAB
SHA1:	DDBE10CC5716861180091B9AD38A3803B2C94DF9
SHA-256:	1FF7AEA985F03965948FB87A312B2586D7BF95BFF736485D3314FDFB869FC423
SHA-512:	E41E0D9E71DFEC634D7C69B8DCD40ADD45F40E338A745445FC49BC7CCEF9ECC600D5C2ACA465C36CD41CB031E10CEB932A7041A6DA71747363A9C819805FDA98
Malicious:	false
Preview:	.........................................B..w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:J5H9EQFBln:LHq0l
MD5:	1A47072D3082D7B4137B8C364656F360
SHA1:	9784D1A83AA5C3F423D244BC1DC7824600E05CE9
SHA-256:	31E9B39662176BF3847D94D5847E03BE48763711F3605C8D6060E4F43CDF0DFC
SHA-512:	3C4C404AD5D66770B6FC7DC31C5090450DE82F97A6A275779424437C5703775A3E376A5FF46F0807E29176C0536D6E6CFA64E4DA48F43E83CFD14D0482685499
Malicious:	false
Preview:	(.....i.oy retne...........................w./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:J5H9EQFBln:LHq0l
MD5:	1A47072D3082D7B4137B8C364656F360
SHA1:	9784D1A83AA5C3F423D244BC1DC7824600E05CE9
SHA-256:	31E9B39662176BF3847D94D5847E03BE48763711F3605C8D6060E4F43CDF0DFC
SHA-512:	3C4C404AD5D66770B6FC7DC31C5090450DE82F97A6A275779424437C5703775A3E376A5FF46F0807E29176C0536D6E6CFA64E4DA48F43E83CFD14D0482685499
Malicious:	false
Preview:	(.....i.oy retne...........................w./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:oM1PR0EX/Z5Kl:oM1P9Xj+
MD5:	392F3A3C104149558B821FABADE5608E
SHA1:	491B280A917060C449A01ABE41CBA02DCCBD2CD4
SHA-256:	0F57BDDD4EB07E30667DBCC853E61D6B7E9C9A59197A758F78D3D51FEA71258E
SHA-512:	478FB7DE3DBB6B158397E15AC8AA2ABF5E79AC97F8EA475C7982B501E694274780DD0E7930085907B37618A55F75C2E39878EA1FF845E4B8C772A1372274605E
Malicious:	false
Preview:	(...u..[oy retne............................w./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:oM1PR0EX/Z5Kl:oM1P9Xj+
MD5:	392F3A3C104149558B821FABADE5608E
SHA1:	491B280A917060C449A01ABE41CBA02DCCBD2CD4
SHA-256:	0F57BDDD4EB07E30667DBCC853E61D6B7E9C9A59197A758F78D3D51FEA71258E
SHA-512:	478FB7DE3DBB6B158397E15AC8AA2ABF5E79AC97F8EA475C7982B501E694274780DD0E7930085907B37618A55F75C2E39878EA1FF845E4B8C772A1372274605E
Malicious:	false
Preview:	(...u..[oy retne............................w./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlnts:Ls3
MD5:	7EBEFEA8A2C566BF1D67BFB0A50CCAD0
SHA1:	3650C50F4701A63BB5968FD6E3A991761D90369E
SHA-256:	17625411C10030241013CB4E94DCF4C29AE62388AFD13A16F04DA2DDCDC4B008
SHA-512:	1CB90EC643B3B7AEDAF87D8C6B65BE8A8ADAFD078C1F957B20CA8B5F253092825A4040B6C15088ABA47C28BE1849F67664A6F333C071D93EEFE3EF4413ED6ED4
Malicious:	false
Preview:	........................................n...w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlP:Ls3
MD5:	C87360610DB1CCDC4B22B3CDBD8A87B0
SHA1:	297F4BAB19D9134A7A74CF6621EF3C2B10CD661D
SHA-256:	DA938D37005D0F420427E2FE8B9331AD0D4339CF074735C706181F6CE9B808BC
SHA-512:	2D886052C98D8BCDA8D562F790A81B5E155FEA7A38E8B186A7B35F90DDC2510CE98EA58318938D12139B430580AD70D95F86F76B1691A03C0B68E496CDAB7D83
Malicious:	false
Preview:	.........................................(..w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.229541253161711
Encrypted:	false
SSDEEP:	6:wbwq1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLlcfq2Pwkn23oH+Tcwt0jqEKj3K/2jn:Sw1fYebqqBvFLYvYfYebqqBQFUv
MD5:	2EDB6DB62D74E6F8EF2D611CAD346F98
SHA1:	80AD8223A5F3FBFE38EEB7FF5D7CB76F585B88E3
SHA-256:	2692DE8F428188301D8C21726074145225D9211D46A87B42576F220F9C660B37
SHA-512:	E8BFDB820E2A14B5FCF607293FE9E09038FD3CB8B37C2F72255E67D529771968A22257FA0C991CDFB90F77B6E4DB689F797B3CC735534D98C9E6AA9A73EF6ECB
Malicious:	false
Preview:	2024/08/30-02:34:57.633 1cd0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/30-02:34:57.706 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\525afe11-eaa5-4075-b41e-e550da13f77c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3ae04.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a1841503-2a03-43a5-94c5-983883582fd4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c9647033-c9b0-43b5-91e9-fe4340b90221.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f4ee02e5-8628-486f-8d00-325c555620e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.196465854031744
Encrypted:	false
SSDEEP:	6:DU2+q1wkn23oH+Tcwt0jqEKj0QM72KLloiq2Pwkn23oH+Tcwt0jqEKj0QMxIFUv:DUD1fYebqqB6LrvYfYebqqBZFUv
MD5:	465929AF7F952CA24748C76FA6EEB88C
SHA1:	E7A8D3CF254FCF18E677E3A22BA8FA87AA25050E
SHA-256:	6EA31A207452F892924D8760D1181460E9AB815FBF0F5D7CDB7F74C8DA631837
SHA-512:	7568D48C27982135C6F2D7EB173E737B0715D2357FE727E0249627FB3BA83D8D5EB43BFE5E7A2FA688CBF165451ECF964748437E80CF1450122705E37A34F3F5
Malicious:	false
Preview:	2024/08/30-02:35:13.387 1cd0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/30-02:35:13.414 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2555187950348055
Encrypted:	false
SSDEEP:	6:N181wkn23oH+Tcwtkx2KLlo+q2Pwkn23oH+TcwtCIFUv:NVfYebkVLO+vYfYebLFUv
MD5:	BCB5821EBEAFBB4835F9C36228B34360
SHA1:	07F9AF0527A640E5AC5E63506558CB5F94251101
SHA-256:	66B9FCE2C7747516607747C63CE0E9408F3D84E735350BC91CE49BFB0371AA46
SHA-512:	5C2DE269F798D28948E93BBED5D23D067CDD67D3D61189CAA22230FCDC80061B4F3051480EC07DC6BE37CC0622C1498B92FDA5518F0F61CCF91A6A7A88923C48
Malicious:	false
Preview:	2024/08/30-02:34:55.537 bbc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/30-02:34:55.957 bbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVwiG:IiVw
MD5:	76E1D6C3E758AB38C4E1494FBB0F40E6
SHA1:	BFE1353BD19CAFC44395057BE73E9915CB6BA48E
SHA-256:	E47684B9D0CC2AC27102D513162952876B5FBA0F82F4B73613DEDA1BC4674C34
SHA-512:	F13AD7B000041A7A627A16E294353EAF4C09DA6AA3A78B4C3F51A9487719241020B31A218E73B3DD9FA002E9F12EA853BFA5726AC499ABABF660AB06A1BD6DA1
Malicious:	false
Preview:	VLnk.....?........G.j...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0772594287059372
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOZSAE+WslKOMq+vVumY+fn66:e/2qOB1nxCkOZSAELyKOMq+vVumRp
MD5:	17C50100AF473F6AAE9C4DA085732FA3
SHA1:	E4E9C1B102BBA9298828EE31649E14D735ADD19F
SHA-256:	55F03C93F741BA69C5A99CB392A80D227A8B26CF14244C5E4C86E918052BE8DF
SHA-512:	DD8B0342F1D1CCFA5015678EB3E55E4F1D761D20E249A032FDB7B81589F2B137E5731AEFB56410A5D3D80924B1284A2F6C7BBF107B3CF0F505D14B5093E1AF33
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\c8265b5b-9a00-4521-bd8f-492e678a664d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.5660669991325005
Encrypted:	false
SSDEEP:	768:JVt+M3WPr/fvH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ4DxTrwlVpGtux:JVt+M3WPr/fvHu1jaQUxolita
MD5:	FB6E0777E0290457D00AE0739B72E326
SHA1:	52E7927690B759106AEE5709C04E69344372516A
SHA-256:	E29C34C8024AB2CF4F269B229932867F129C5EAA376EBFDA25C49F5F71D3DC26
SHA-512:	AC80590AABF1A601B03306849B856A4426C5B5699C5A3B7F53AF557C1D1DC085BB2248E5CAF37BD5946DB90F95D55E6B55F74E652D05D39FA6B06517F83060CB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369473295443595","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369473295443595","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\d991a853-2196-4358-8720-5a55896f8fbe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.978849013992724
Encrypted:	false
SSDEEP:	96:styqf9is1x9b9ib/zN8z0s85eh6Cb7/x+6MhmuecmAehCQa2Mi/EJ:styXs4rNk0s88bV+FiANPiMJ
MD5:	9F64931250602C15576CD0DE5F80517B
SHA1:	E385142AA0AEEBC006CC5B712B55A5E7D775B754
SHA-256:	859B31C08F45D8E8BFB5D571349880DA03283455BAB54CC343155ECEBB5457CC
SHA-512:	BF0E9843E9017A7CEAA2A4D5997B29C6AD1ACCB869113A0E7F33547D304E9446BF41F04AF0FC3527D9D5F08B4944665C2170916A2189EC297ACC26A092CB5397
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369473297212539","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369473297463527"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/oBillllHlFll:7+/l/cC
MD5:	4EA4CD59E37AD7CF8E36E2D94C737FD3
SHA1:	BA54FDEC8533CDE23A445FF4F9DF4E1FF289176B
SHA-256:	5CBEE9751F1664DA601C8CC9979DF91C5B7EE56053D202CAA59D4AA75E37B073
SHA-512:	529E91E1274568D623B13422473FE0B83639337BFE99091A37B98110CFD5CC74DB613663B387C3A33C1F4510DC44E4AA046FF4DD17B9D5600E41CFE785F53989
Malicious:	false
Preview:	.... .c.....M.i.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.050021942291891254
Encrypted:	false
SSDEEP:	6:GLW0pW0UML9X8hslotGLNl0ml/XoQDeX:axU4GEjVl/XoQ
MD5:	C2580EF8CC0D53AFB42CA2D4701FE6B0
SHA1:	F94F4A9DD6F6D5C5412C0ACCED1852E6A789F727
SHA-256:	14DA86E9644111286ECEEAD3C5775C80C4B6F0181674913C4C53DFC3CCE44B2A
SHA-512:	4883D52962AFC4D9AB0B3C8C1EF170754498E18337F82563ADF65F3E8D90E3CA084A22ABE4142122216F0B7A1BCE8A12AB5CD0CF94D8C37F915045E61E9FC547
Malicious:	false
Preview:	..-.....................K......n.e......U..S..1...-.....................K......n.e......U..S..1.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9977000618049046
Encrypted:	false
SSDEEP:	48:yzxolO+GcbX+in9VAKAFXX+E90x8l2VAKAFXX+xxOqVAKAFXX+O5nUYVAKAFXX+f:CxsQjNsE2KNs3O5NsOgNsWY
MD5:	744C3A2157ED3308BB31416B2FF03B01
SHA1:	C9F36C73F300D49F7CCAA27A7430F783A04C8B36
SHA-256:	2A24F7374F234B7A876DC2252B286948E934DE57874F95A53F81001844FA2940
SHA-512:	CA2ACFD3B918147001A0ECB0C76E6C211F79E0441E69E766E8A38EF6DB475613B910B0B4BD553F60771C2291C88E46B6C92FD0691E28738C0A2E4FA8ACD805C5
Malicious:	false
Preview:	7....-...........e.......h.a0^#.........e.......m......SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.481982143269708
Encrypted:	false
SSDEEP:	48:hQ8ZbLSBSGQtP0HRHSxgIYjIYqzqqkHMYjMY9yxAlkfAlkZ0c3:hC0GQyIYjIYqzqbHMYjMYCYcYWN3
MD5:	9550306B3FA9D8D7C355FD6517FDE026
SHA1:	EA0B773B14F05AB334625ED6E9A87DCB3086DE38
SHA-256:	E7C44A64E418F7924E3AE4498FA5C8475B7D83734497177227E931DD673A0ED9
SHA-512:	191073EB162BC9AB20F99A2B62913BCA7CAC455DB7AD22D7E5079B8B953BC07F07651520E1C8AED56BFFAF3D2206BE0BE2ED8A5709C0EDBEB582246578E206C0
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.....................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.259999950943673
Encrypted:	false
SSDEEP:	6:02yD1wkn23oH+Tcwt0rl2KLlOOG3+q2Pwkn23oH+Tcwt0rK+IFUv:gyfYebeLPi+vYfYeb13FUv
MD5:	93E3A3AA4272379DBE7AA2DA6BC7D2C7
SHA1:	BF42DFBFEDDAF962233C5A3E2491F94F82065F6F
SHA-256:	00ED66BC6E41B848DC6315EB0AF93137EFCF7F3674E28461BB05CDA12AFF7547
SHA-512:	E55986E39AECEB09CDA9CBB82C0E563F78C6547DC73BB11D51272288FA0AEFBA33DD5174495D5F270939F85A7BBFA61FFD83D30BDB25F6C6ED2D50837C825D15
Malicious:	false
Preview:	2024/08/30-02:34:57.236 bbc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/30-02:34:57.245 bbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.958141412815535
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Wui+it/4JbZfPStub/RG0lbANqa:G0nYUtypD3RXi6FZfc25m
MD5:	FBC524D02048C176A0A5D1B8B752932A
SHA1:	294C48557549A4C978326D9B7969E293A024F157
SHA-256:	F3FC95AE128DB918FC126F15CD9D96618482BA6ACCC622AAA19B10CE80B15EA0
SHA-512:	9B6434442E11610B8B5DDA43AA56656599925C9C8F0A364DDB69D15B37A912D223EE600012468E0DB723CAF3546FFBDF56F085A0159EA7968BBACE894AAFF856
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................37_.......`.................38_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....:.=..................3_......W2..................4_.....)..>.................37_..........................38_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.208065062298899
Encrypted:	false
SSDEEP:	6:0zR1wkn23oH+Tcwt0rzs52KLlOf+q2Pwkn23oH+Tcwt0rzAdIFUv:Q0fYeb99LI+vYfYebyFUv
MD5:	C603CF7516CE0D8ADD1942A5C2EA964F
SHA1:	7EB5A702D4313A9DE17F691AE67733BF227248CE
SHA-256:	87E7531620CFB823278C54EE756FD310235B3C2829FF111EC2AF48209DCCED1A
SHA-512:	3C20A9CCD6E66FD270F86FB9BA4C76311CD298EDDF15900F86CC2033825869FCE3162622E7E150927F2E4D5F23512D93958E54D380A10B33EA32AE6EC15BC2A3
Malicious:	false
Preview:	2024/08/30-02:34:57.221 bbc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/30-02:34:57.232 bbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNldl:Ls3n
MD5:	1C57486BDF026A98355092693768E416
SHA1:	BDBC1D85D4FA3F20CA1DE4D6DB612EDBB17E968C
SHA-256:	961D2CBC2B2E061C4DA134A64E6EB46F5C9668A60880F912C1D736E8DE9DEE10
SHA-512:	4E8F53CAA82B254BDC53A077C4C5CA523041BA9A3979C4662ACB8A51FE6E96383D631AC09A384BE2E0C582BC9F300690FD13CA1834390C9AB7428B7CEC6642F3
Malicious:	false
Preview:	.........................................R..w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlLJk/:Ls36
MD5:	1C54D6D1686D7046EC6AE30E5F1C384F
SHA1:	673B9DA35736AE7D615580A63169814A006EEFF4
SHA-256:	E3AEA2D0558F94E0FB3FDD095D61AE397256E0D1A958796FC9381262B39AB434
SHA-512:	1876591706759EEFD5E18D03CB552CC4934D44A5DB7E5E54096F0D77BC3AF1D3F8714FC5010F57AD671C27EB14DB75A493A4CB0C9D9D5B19BC1F783B93DADB57
Malicious:	false
Preview:	...........................................w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28217.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28226.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF284e5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF285d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2aba7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2e630.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF33d39.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF36e3c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3955b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3f85b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNll:Ls3
MD5:	4B9B75FEDAC2F5168CA34F13A6ABE545
SHA1:	9876F533E9265473EFD0B24AEF86075EB3286C4B
SHA-256:	5B43A728FAAE8392400E1700453FE829929CBBC7FBF0CC3F85286903E74C9F76
SHA-512:	736E0E2228B46D1FFCB75235B2A03D8553F8A0C69372C58BA47ACE2CBB53D0A1371E79E868BC001CF62311D39D5FFDEDA85E3BC5E6744DD9B5829C9C0EC3744B
Malicious:	false
Preview:	...........................................w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\b5f3de24-8950-404c-b09b-f5213be2d808.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.595813348039832
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0aflUQWwPaZLkHB+jdrxZvBeuGRVPaJkXFccOJwlRt1Yt9B0:Xq8NkC1flUli2KB0Pvg9ViJk1ccdG9q
MD5:	F3251321C4713BB1883BE32637B6F222
SHA1:	8788567B495395C418E0927570CBBF590D727228
SHA-256:	CA3AC6610B6C4A797EEC9C3DFA528595A0EA6C3A23AA64776A8108E23FC49408
SHA-512:	75DC1861475AE48F5C617D8F00A4F58C289590AFD4E32943BDF0F9930EF4AF9185C0456B1B93C3A6CA9A76671A2B188752C8AC3459B6C4476B58D4D7DAB863EB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"policy":{"last_statistics_update":"13369473294761918"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\b83ffdf6-9f25-4d4e-b2c4-ff51d1834d19.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.5514033362695505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtHHUQtkclmEPan+yikmRJdXBuBuwBea3FaNh45X2pQQRCYfYg:YuBqDPaflUQWwPakLgBzBeR45tB0
MD5:	1B3E9CC39C6FB43A38DCE3FA92C68685
SHA1:	C85A0DDDFF2F4F1A67B85A67DDCFA92499D14342
SHA-256:	AB61A170BB75B977BF7A8523AB459B7E9035BF935252F19D271F357E655AB746
SHA-512:	B1E65C2E248A938963644A1B4CED3FD0FF9231D494A156B1890F679A5B0729C35246073F793C478AADD7BC5968BAAE7243B124C2F4A9B3935202188849506F17
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369473294724449","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724999694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\cdbdb1e3-6cc1-4af6-8d59-2d86f86a537e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71525
Entropy (8bit):	6.072672496104025
Encrypted:	false
SSDEEP:	1536:BMGQ5XMBGAyiWgD5uc+PajmJQx1ehTM3VZ3SaZcm/ebKdwJ9ThsMe+zUUTcrBshm:BMrJM8AyiEFPajVtVhSamBbjtu+zUUTc
MD5:	0BBC115F777DDEB3BF91C6AFA25B6D1B
SHA1:	D1BBD2DC77D90D169060227A66ED1A4ECE3BC355
SHA-256:	399594CC4E9CBCA552836ACC1BDE24B0DC04A6614DD394E74CA4A219A58434E4
SHA-512:	F591F439D19A4436C746EA621EFF91A1A9A2738BC47FE1B4C5B4FEC71E013A9804786423736B12F6CB4C1C7B1946DA4383E58F0599E63916D44BBF040751F893
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369473297510885","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f5c902a2-b1ab-47ae-8282-10369abea709.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.595813348039832
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0aflUQWwPaZLkHB+jdrxZvBeuGRVPaJkXFccOJwlRt1Yt9B0:Xq8NkC1flUli2KB0Pvg9ViJk1ccdG9q
MD5:	F3251321C4713BB1883BE32637B6F222
SHA1:	8788567B495395C418E0927570CBBF590D727228
SHA-256:	CA3AC6610B6C4A797EEC9C3DFA528595A0EA6C3A23AA64776A8108E23FC49408
SHA-512:	75DC1861475AE48F5C617D8F00A4F58C289590AFD4E32943BDF0F9930EF4AF9185C0456B1B93C3A6CA9A76671A2B188752C8AC3459B6C4476B58D4D7DAB863EB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACV08DUwd4SOziRj//tt4Uq8mxAM+ZcYJyut92kylFVvQAAAAAOgAAAAAIAACAAAAA2fCVZUzODblovC8HaQQWMGvQ+BOD4dY6uNVl1PbHZ3DAAAABs45F3EC2h7RaCSC5L5xUfxzFpcUyGDo4Kvq0EjHKxsstPMV/COD1khSGiOO7ifY1AAAAAWgswPd0Y32DuNcIAd37NLklelwg5bphjWYCPEeS1se3gzXokURDQwTEvF+kL9kZf3Bo3LrJQETTEuHvw7QqEyg=="},"policy":{"last_statistics_update":"13369473294761918"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\014d2fd5-56fa-4df8-8a40-2e7727e5c644.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24722
Entropy (8bit):	6.053410134345686
Encrypted:	false
SSDEEP:	768:uMGQ7FCYXGIgtDAWtJ4nBXcNzHmBh02tdP:uMGQ5XMBGqNzGjn
MD5:	832AB1526D779693F947140D2585BC1F
SHA1:	226C5A15EB5A12A4D3E2567BD21DF79AA42C305D
SHA-256:	D4E115F11A69B6818C330F43DD5F695DCFD731BE4AF029B2C6090265D0898BA4
SHA-512:	D08910C89449C598A095F9CA06CC5F7FFDDDA2F0F8F46CDEFF5C2B689193C13F61122AB08462801B0B913F32302B03654A66BDEA1F978F7A6165D54059472C99
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369473311111549","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\03703a49-ae3f-4cde-bc81-c31e63cb42ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.829227272462731
Encrypted:	false
SSDEEP:	192:fsNwtdeiRUpc13Q5Pyik1+96qRAq1k8SPxVLZ7VTiB:fsNwfYcg5qh1+96q3QxVNZTiB
MD5:	98F3320AF6EECE9C9B57A83094A57C4F
SHA1:	7ED33109C22E0395C5A5E328898D21FB705EC63C
SHA-256:	A6C7E2383DEB5D086108750526D581EA8DCB30DEB909E8B45FDA006412D1F07C
SHA-512:	96405CCF364FB17D53E7C9C0E2F3D3B95A7F36FF3842EACC9A83B8529A36189EE25D0443FF67E24CA83CABE7393917D808549E0CE3BDFB40EFCE235F6E5161A0
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\293754b9-2b85-4ce4-895f-cd5b8b063c92.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4039a8c1-8c20-422b-b96f-2eeecc36e197.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.829153880213527
Encrypted:	false
SSDEEP:	192:fsNwtdeiRUpc13Q5e1Rk1+96qRAq1k8SPxVLZ7VTiB:fsNwfYcg5CC1+96q3QxVNZTiB
MD5:	1D1576C139D540A02E2528028641750B
SHA1:	1FBF0CAFBF1EFEBFE986FC9D85FC3F7F2E260120
SHA-256:	EC06CCCEE766F3ED39ADACAA528D5F7242DFC2FE737C39AA62F6D92C6F968B70
SHA-512:	9B2BA0D01199D582C683E07B4E8E059AFB9B2AF77FDC52A9EB5E6FF1BCF96B46712141FE5C0F512B06CB13E606CDDC930016E9E79DF18207DF8408F099CE08A7
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5d6cb213-a8b5-44c1-b1cb-31388191bcdb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.829153880213527
Encrypted:	false
SSDEEP:	192:fsNwtdeiRUpc13Q5e1Rk1+96qRAq1k8SPxVLZ7VTiB:fsNwfYcg5CC1+96q3QxVNZTiB
MD5:	1D1576C139D540A02E2528028641750B
SHA1:	1FBF0CAFBF1EFEBFE986FC9D85FC3F7F2E260120
SHA-256:	EC06CCCEE766F3ED39ADACAA528D5F7242DFC2FE737C39AA62F6D92C6F968B70
SHA-512:	9B2BA0D01199D582C683E07B4E8E059AFB9B2AF77FDC52A9EB5E6FF1BCF96B46712141FE5C0F512B06CB13E606CDDC930016E9E79DF18207DF8408F099CE08A7
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6416ccbc-58f0-431b-a632-ae03d4f2953e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.802728011030887
Encrypted:	false
SSDEEP:	192:fsNAtdeiRUg/QUk1n6qRAq1k8SPxVLZ7VTiQ:fsNAfTYv1n6q3QxVNZTiQ
MD5:	57D00AC5D8544C88BE82454A08DAA4CF
SHA1:	D8CC35854C58FB82C497C1283839F3C4FBE0488F
SHA-256:	ECCDEB2B149AB32845C2B5FFC7F4C338F431C1BDB3BB8BDB20A31FC25F61B972
SHA-512:	D86409FAEB96BD7C62D30A1A847B43DCBA8334550FB5A6DBFF1EB32F1327D0BEF860C60310A0A04B63A3C443B89D2A5F63274F6A502B0FC86477BC01466A1B00
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6fe1bf06-d28c-4982-8198-bb8765da18a8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.7964857768606555
Encrypted:	false
SSDEEP:	192:fsNwtdeiRUp/QUk1n6qRAq1k8SPxVLZ7VTiQ:fsNwfYYv1n6q3QxVNZTiQ
MD5:	33C33C965BCA8E76A1EE255D86CC59B7
SHA1:	BB4ADECFDADB4C2E6A748694904C731581CA0BF1
SHA-256:	896A5FC78AB5674D2A89EEA903868A761DB4C3C0D0D8D28949BE364E4A554A6E
SHA-512:	B9AA2D1D02C3A385F6D5EFE383F944EE091B13EFADF975213A553943DD61C8DAB619382DB3C901DC8AB185DA3F27571CAE9CE27301CEA9B61D2B0F3A82A9CBBA
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8d52d8ea-523d-4437-9eb9-ae48474455d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59852
Entropy (8bit):	6.081199186597034
Encrypted:	false
SSDEEP:	1536:uMGQ5XMBGNaf8dP0SAj0dOb8q1TjHBNzGGn:uMrJM8IkdP0SAI08O5NzGGn
MD5:	B08836910840EE1C7605111EA8C8A3A3
SHA1:	815099DF7132E74A97198EDE39A23633B4B990F2
SHA-256:	75DDB94FA95BD5EC3C8C9A4A5B7830E7D51BF9BE39B608EA944BEB5E12E40C0C
SHA-512:	531ABD4CA315E4E3E44FBEB5ED2ECE873823FDFB325D4C146B9F7A616AA2B021E156EE88ED0DF9E69EBC4E70EA91FD75EF5F15CD5273D5CD4BDE85B59F0273BB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369473311111549","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\086f1b23-095d-4bbe-b0f0-8d17c1d445f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D1681E-2290.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.31097931585860217
Encrypted:	false
SSDEEP:	3072:4Dc42kSXdeDlkYaMY/3TEXmHYI6ipm9mgRbkjpG+p+zxYENeo/ofbdjy1Uf9GBnx:FkXkM9mgRb6snwvaHfzLN
MD5:	6B9A9EFF1A225D145548DF9503453B9F
SHA1:	D3515C644A371BE9AA6EEFE37D33A1095EA7E4D4
SHA-256:	3EBCFDCD39A47D4283A1FBA971E8700D32CE38F122044ACC67B41E02AAB91961
SHA-512:	6E83E84FC7BD771C388D3C0801951DB8F2688BCF659F49A5C7F48BE1C78F02652EA87C5748E539832844D70A82E3C33DF43D03EF769475BB32A88D16801C9848
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xM...L..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".jsevgx20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D16827-25D4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.039704236262609896
Encrypted:	false
SSDEEP:	192:6Y0EbtmqvDtKX7eTJEa3XxxTVwg7XviV0DA5DhAVN/K+O1gQtnErYq01n8y08Tcp:10EtLTeQtKnhUHag0E0X108T2RGOD
MD5:	FE3E10B77FE49F9EC1F58E5E0E8D6F7E
SHA1:	2478F4111163DEFA201123F8F92A30313DC6A915
SHA-256:	4F6A6EC1C2B3EDB199C6639D1B56ED3949CEC71446E8A4A201FC645688B2A859
SHA-512:	76C61AC4BE25AC5933323E779F76B215B53CEAE6DBF5D4545F1B94D5A92F28A4AD27D675CFAC88EC36258B3AE636D7BE83871EDA154831C2F53E44F7D4E17F1F
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".jsevgx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D1682F-27F0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03877668009229954
Encrypted:	false
SSDEEP:	192:Du0EbtmqvD3KX7ezJEa3Xxx7UpXxgg6zfhj1NEzHDtM1gQMLjwO8Wqln8y08TcmQ:C0EtdzeZVQh54BsgPEiS08T2RGOD
MD5:	804333DD3F553B1409D0F15DC3A15D5D
SHA1:	E69202088FD34D07E1954268B188CCDC258DEDCB
SHA-256:	8228EB34705FC6B53464A5A6649D9780D2FAEA3EB1F99817A24EB12CE0E39BAD
SHA-512:	532FC149D3365BD57D3A9EBCB3F594B5C3FF01203E14A6AEDF89A87CACD657E5AA1E57EE31E347D6575391C89425C6D60C0A6BBE133314A0CDBF323045D5D198
Malicious:	false
Preview:	...@..@...@.....C.].....@................\..PL..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".jsevgx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D1683C-1724.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03883307218051472
Encrypted:	false
SSDEEP:	192:2o0EbtmqvD3KX7dJEa3Xxx7UpXxgg6zfhj1NErZGtM1gQMvQ9ROahq2n8y08TcmQ:F0EtUeZVQh5WWsgr8nh08T2RGOD
MD5:	881C0ECC914261BBF8534F20C1AA40BD
SHA1:	F4D0B32188C4F67E8EBFAC5C7F8F338D0EF3283D
SHA-256:	CA76D3853FA479CF8CF95183F6A8299B136916A5820BF5EAB7BAB9E3CAF054F1
SHA-512:	73108CD7EED605596C016603D44B074C74AF656079D84EA7E1FA484543A13CCFC5ACF2A57B0AAE77E753048E9D3653EC6E4BA5D9AEF3646F285BD96AAB5DA6B6
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".jsevgx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3ee18dc1-27dc-4478-a0ab-667057181c71.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.061496160641729
Encrypted:	false
SSDEEP:	96:sVQqlNJ1Xb9UbtlXbRt0fYPsY5Th6Cp9/x+6M8muecmAeC9e4zvrQF2X6gE5AtE7:sVQiJ6tlVeYPsYPpj+FVABQFFBf
MD5:	3D863CEBBF42DFDA1D3F4F44FB300BE6
SHA1:	AB3CBD2C8FF23F863C942A23CD150E7CDFA805BE
SHA-256:	42F96A1EE47912A91DB093AD2B4FD0676B2F7080F5843D6F691169A0B0072CB1
SHA-512:	27835A44DF1239D6DD72D267C7C8E5A86AB9612ADE8902CF397A62B52D0117D6CC9ABA0CE928F5D7DC28CA8BEC6B6E2265F39D7DB86908B64F8FF195366ED19A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369473311105966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\407a4e38-e9c8-4f6f-80db-1d01c899f663.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4e9db2f7-2e61-4fbe-bfcd-a35461d37640.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9334
Entropy (8bit):	5.17015315168665
Encrypted:	false
SSDEEP:	96:sVQqlNJ1Xb9UbtlXbRt05GRa1adYPsY5Th6Cp9/x+6M8muecmAeCVAe4zvrQF2Xo:sVQiJ6tlV/kadYPsYPpj+FVAIQFFBf
MD5:	BD3B4A2CBF05A06AA18EBBFB7AB209A6
SHA1:	370A771DBCEA3F91A03D301B0F348BB32FE5659E
SHA-256:	6D19BD6B227AFF3E4CC8F302657F79D6466C64A9B4C04799BE6608813D2DD097
SHA-512:	6F07AB7A46A3ECE8FEC63F8EA5526DB882DD659D3C958D76D9239A35D0B868FCDE01E6A030A9717F58E24D1A4504E68DCAE36ACB0EAF40E27FDBB80AC898FB21
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369473311105966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\605d7a5f-f2d6-4df2-924b-1387dbe80c6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.565864049130409
Encrypted:	false
SSDEEP:	768:7ScC4C7pLGLvUxWPPHfEq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnTBbwpSrw/kp9L:7ScC4acvUxWPPHfEqu1jaKTBEpX/Std
MD5:	1710905DCE17B91D54982E9B82E5E21A
SHA1:	F4A029AFC847D6326E729EF1266706DBAADB713E
SHA-256:	E4938A1DD8BFCDCDB437352AAE7BAF1401FB90C6F75214130BF60B2507773FAF
SHA-512:	4515632C90AAE57DB1CDDA353543535F25187A800B4D2B5AE3116960FA697063E6AE1FE7773BDAFD73A404B9EAE2812CF5DFD22FD32F6F50AD2010590BAB2B1B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369473310853501","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369473310853501","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9a6c566a-1800-4c6d-bf3f-0e3636f18413.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558076315651454
Encrypted:	false
SSDEEP:	768:7ScC4C7pLGLvUxWPPHfTq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVabwpSrwbkp9tu/:7ScC4acvUxWPPHfTqu1javEpXbStw
MD5:	7142426AA054400A4CCB1310D2DA5B22
SHA1:	7669FA65D00E805168A29ED3EBC42878F7DF4434
SHA-256:	B60CDF0113915D422E6909A8C54216780CD3E05EE692A443B390FF56D3E38D25
SHA-512:	4F548327E8C55558ADA23F0182831990A5902D907877D0B1741D8B9E83A0DC9C9AD0333296203E00E74217EA3B0006AB9324A03FD61D39F2C34B6DF89853850B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369473310853501","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369473310853501","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321815213087006
Encrypted:	false
SSDEEP:	192:DAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:cOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	88BB187FD9781F4683DBDB8681D260A1
SHA1:	90CB87B7D982FCF65BEE2084DD27FED381D7C352
SHA-256:	4B99246BE23C62B7A3DEBB44B498DD989ABBABC6DCCB4D611372EED49B7A40DC
SHA-512:	B9148C80A9D1D3CA0BF308EFC48D55EAB58B87690AFA0375908D01AE72EF3A213EAC72589A76CE99EB64BBE6C47239CD3997720518AEF588570B50B65068ECCD
Malicious:	false
Preview:	...m.................DB_VERSION.1.~...................QUERY_TIMESTAMP:arbitration_priority_list4...13369473313043268.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.091713432423915
Encrypted:	false
SSDEEP:	6:w4UV0q1wkn23oH+Tcwt9Eh1ZB2KLlCWu4q2Pwkn23oH+Tcwt9Eh1tIFUv:dM01fYeb9Eh1ZFLru4vYfYeb9Eh16FUv
MD5:	2A734A29BFAB2BEDC09BFFDF8B3F1B8F
SHA1:	0C737E1DE13BCC6AFB40EAEB44E39CD24B796BEC
SHA-256:	AE0A1FAF8841975419DFEB2DADAA8D379FA00FD124CCB1351BD9161DF9C5F1CE
SHA-512:	B7661EED6077F2E338382331BEA7FADD56BE28D4634CBB536A52F755FE7E18F344416C2E3966BD0C8967D854ABE0B26A6D8295192F4F068A044656674BE86BD6
Malicious:	false
Preview:	2024/08/30-02:35:12.286 1cf0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/30-02:35:12.334 1cf0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlYuQKl/:Ls3Yufl
MD5:	7794E8CFF73D716122969D36DDAFA7B2
SHA1:	9C5ED8CD145BBEC914A23B5DBE651DF178416822
SHA-256:	5E4036ABB0A7523DA30D30F54EECCFFF993016173158118EF704F77847BBB9B5
SHA-512:	7D0EA07FC7E574B4FB5D86B07C0A51D1CC6844331004FC1EFF9A10EC12D51128213B5D255FDDEAC3873FE08249C02C26A4EAB821F6AC8DA3DFDF1E8A723C52EE
Malicious:	false
Preview:	........................................G..w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.185868977638341
Encrypted:	false
SSDEEP:	6:W/Req1wkn23oH+TcwtnG2tbB2KLlDnL+q2Pwkn23oH+TcwtnG2tMsIFUv:W/RSfYebn9VFL9yvYfYebn9GFUv
MD5:	88479345FBC7798F5E3D50DF5EDE0310
SHA1:	8B72DF61BDAF1A531CB9BF78793198AD560C9F57
SHA-256:	269F76DC8F86CB1A9DBCDFDDD83739082D7E681E7963E601A0DD287DBDA6A590
SHA-512:	E2F017AC09F3002AE14A18AE83563E9045E169034F0F24C5900447033E1EBDB4F586F4DE983716E656E97247F644C056BB29CA93B1E7DCDEC70912D3C917806D
Malicious:	false
Preview:	2024/08/30-02:35:10.853 2338 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/30-02:35:11.044 2338 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.191407127766145
Encrypted:	false
SSDEEP:	6:c1wkn23oH+Tcwt8aVdg2KLl0F39+q2Pwkn23oH+Tcwt8aPrqIFUv:7fYeb0L6N4vYfYebL3FUv
MD5:	08D5FF3E2D3E6DCC3316DFA46407FE72
SHA1:	9204C1C6CC600BC0077741EE7D21E1C3D978D37E
SHA-256:	CF7E4F9A9FCD84116842594D8E5A8A36B62BB87557FCAE592A5596712DE6ED2B
SHA-512:	94F89C23DB61A2E3246AE3CFD5B390658C68C89BC9EADB5C4D205AA4C1D66857ED5449CB13F31C631E874CF0B864798FEAB962771DEDCC2FBA3DFA123FD0DFC3
Malicious:	false
Preview:	2024/08/30-02:35:11.065 2378 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/30-02:35:11.276 2378 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.175550794772334
Encrypted:	false
SSDEEP:	6:31wkn23oH+Tcwt86FB2KLl9VX9+q2Pwkn23oH+Tcwt865IFUv:2fYeb/FFLdX4vYfYeb/WFUv
MD5:	6D9FCAFC36CB44F7C4118B2553CB98FF
SHA1:	EE33BCCC7F210D75AF5B6639FEFCCB42A327681E
SHA-256:	CA3F9092642BFDB831067C976A4FFEDE72D2C3229E07537C563616638804F83D
SHA-512:	D7B875581B03D42C6D0003ED96003E5EEB101329CA66E5621BCE1B1B662EE33E72FBB6E2A0746A5274AF2FDD6B69D1767F02826556F2ED8A99AD3E7C81D6E046
Malicious:	false
Preview:	2024/08/30-02:35:11.277 2378 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/30-02:35:11.297 2378 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.16014298516299
Encrypted:	false
SSDEEP:	6:Mw9+q2Pwkn23oH+Tcwt8NIFUt8VwJZmw+Vh9VkwOwkn23oH+Tcwt8+eLJ:x4vYfYebpFUt8iJ/+fD5JfYebqJ
MD5:	36864DF9C1095473CDCD30EC5DC67F37
SHA1:	9140EC1DC79235B734B65743CAFDCE4CE55B2518
SHA-256:	6EA9B92AA8D70C5CFE5D35D2C131DEDDEA78B0E3A867FB243EED3E622C350FE5
SHA-512:	3E2947D5E9F061F0482B3582B5222846CDFD9B55188430BA46675B7764DE7CA31A5464AA8B57FBBF9997E9957E1D1BD17C2B32BDCEB5AE471E676114F5D08BE9
Malicious:	false
Preview:	2024/08/30-02:35:11.341 2378 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/30-02:35:11.341 2378 Recovering log #3.2024/08/30-02:35:11.342 2378 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.16014298516299
Encrypted:	false
SSDEEP:	6:Mw9+q2Pwkn23oH+Tcwt8NIFUt8VwJZmw+Vh9VkwOwkn23oH+Tcwt8+eLJ:x4vYfYebpFUt8iJ/+fD5JfYebqJ
MD5:	36864DF9C1095473CDCD30EC5DC67F37
SHA1:	9140EC1DC79235B734B65743CAFDCE4CE55B2518
SHA-256:	6EA9B92AA8D70C5CFE5D35D2C131DEDDEA78B0E3A867FB243EED3E622C350FE5
SHA-512:	3E2947D5E9F061F0482B3582B5222846CDFD9B55188430BA46675B7764DE7CA31A5464AA8B57FBBF9997E9957E1D1BD17C2B32BDCEB5AE471E676114F5D08BE9
Malicious:	false
Preview:	2024/08/30-02:35:11.341 2378 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/30-02:35:11.341 2378 Recovering log #3.2024/08/30-02:35:11.342 2378 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3281731663735024
Encrypted:	false
SSDEEP:	6:4iA/J3+t76Y4QZZofU99pO0BYkqR4EZY4QZvGe:ohHQws9LdyBQZGe
MD5:	333EFDD54BF4D354DEB2987BB74834FC
SHA1:	A288FECBCB0028505E4651CA4FF40F452655B489
SHA-256:	EA8245A6538908FE59DE11E27C6A8560928994933A34825F3B9F33E0924EED0E
SHA-512:	0A6823911CC93C4A5C695A78EEAF37B7286F145FF2E59713883C6C92285FC654F6FDE87CE80446E52D84886E533272FB8F73BDA1F7E5F2FD6D097BA1DB230175
Malicious:	false
Preview:	............bN.J...'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.2287961760899035
Encrypted:	false
SSDEEP:	12:GfmvYfYeb8rcHEZrELFUt8fff/+ffN5JfYeb8rcHEZrEZSJ:IkYfYeb8nZrExg8nAfJfYeb8nZrEZe
MD5:	1330E18757B974119ACE0DF78E1D3BB4
SHA1:	C925A23F6AD73189B9563A91BF0EF52B92AFA817
SHA-256:	535D0EDCAB0D4BB4AAEFE3F0E8B32295F22B6F64F798FDF6827E35DE7F6220E0
SHA-512:	EB39141C8E348910D789457AF774C3441A4ECEB4A383B45A0F43B70363297FC6C3B052630D702650D15AD7ABCAF0B35F13361F808F18F20F814A1B135C17959A
Malicious:	false
Preview:	2024/08/30-02:35:11.923 2300 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/30-02:35:11.923 2300 Recovering log #3.2024/08/30-02:35:11.923 2300 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.2287961760899035
Encrypted:	false
SSDEEP:	12:GfmvYfYeb8rcHEZrELFUt8fff/+ffN5JfYeb8rcHEZrEZSJ:IkYfYeb8nZrExg8nAfJfYeb8nZrEZe
MD5:	1330E18757B974119ACE0DF78E1D3BB4
SHA1:	C925A23F6AD73189B9563A91BF0EF52B92AFA817
SHA-256:	535D0EDCAB0D4BB4AAEFE3F0E8B32295F22B6F64F798FDF6827E35DE7F6220E0
SHA-512:	EB39141C8E348910D789457AF774C3441A4ECEB4A383B45A0F43B70363297FC6C3B052630D702650D15AD7ABCAF0B35F13361F808F18F20F814A1B135C17959A
Malicious:	false
Preview:	2024/08/30-02:35:11.923 2300 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/30-02:35:11.923 2300 Recovering log #3.2024/08/30-02:35:11.923 2300 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.155572549982006
Encrypted:	false
SSDEEP:	6:IUcX/q2Pwkn23oH+Tcwt8a2jMGIFUt8RUCCZmw+RU3+kwOwkn23oH+Tcwt8a2jM4:povYfYeb8EFUt8yCC/+y3+5JfYeb8bJ
MD5:	6303500B6DB0543F568255CA8DA031CD
SHA1:	8777CF1993D7948B6B595712BB6B01050B97FD19
SHA-256:	FED5F2647AFEA20C04C18D9890831D2722E0297DC9F8C33A12260AA31AF6CF12
SHA-512:	3D7885765F419532229B83E1B434E7593055A4A1D2C503264767758CDCC48360D1C6DA1631CE082AF87272EA49E18E94D744B0E0A7813BDB93B9F2FD434B5539
Malicious:	false
Preview:	2024/08/30-02:35:11.711 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/30-02:35:11.713 2090 Recovering log #3.2024/08/30-02:35:11.718 2090 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.155572549982006
Encrypted:	false
SSDEEP:	6:IUcX/q2Pwkn23oH+Tcwt8a2jMGIFUt8RUCCZmw+RU3+kwOwkn23oH+Tcwt8a2jM4:povYfYeb8EFUt8yCC/+y3+5JfYeb8bJ
MD5:	6303500B6DB0543F568255CA8DA031CD
SHA1:	8777CF1993D7948B6B595712BB6B01050B97FD19
SHA-256:	FED5F2647AFEA20C04C18D9890831D2722E0297DC9F8C33A12260AA31AF6CF12
SHA-512:	3D7885765F419532229B83E1B434E7593055A4A1D2C503264767758CDCC48360D1C6DA1631CE082AF87272EA49E18E94D744B0E0A7813BDB93B9F2FD434B5539
Malicious:	false
Preview:	2024/08/30-02:35:11.711 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/30-02:35:11.713 2090 Recovering log #3.2024/08/30-02:35:11.718 2090 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0414f806-fdf3-482f-b590-2c0f5d8f9307.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\700c49c8-a9fa-49b3-b0b2-ea78459e6fc7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.300219315453794
Encrypted:	false
SSDEEP:	24:YXs7JZVMdBsnZFRudFGcsyZFGJ/dbG7nby:YXsD8sZfcdsmgzbZ
MD5:	231FEF7725AAE9235D532E88D2AE9D18
SHA1:	EA9066A67398E4AA058AE0F5AB584761833C2F0A
SHA-256:	15EE14B614000D42AFD9880002FC2896EDFD273D09049294A1B63AC5D0DDCDE0
SHA-512:	D551282E2E9742B360FFB53F130D3802FC0E7F4C2728ECA2388EFBF408C1B831FA09320BD5ABD3C7393BA19788E2D49770974890855DD0AC1D5E7CE0AE42A1FA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372065312972031","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372065314709927","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372065317220572","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\946b51da-008f-4bd0-8d2a-446d5485bdfc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2ecc7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3da25.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2c605.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d519.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2ecc7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6856127-0998-4e98-9f83-cfd58d742e3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac205f7c-d8c9-41f7-9ef2-d27a7173ea8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ddc0d830-c624-4415-ba3a-ce526fd1a27e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e95cd986-e8c1-4d71-968d-67cd8886f8bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.061496160641729
Encrypted:	false
SSDEEP:	96:sVQqlNJ1Xb9UbtlXbRt0fYPsY5Th6Cp9/x+6M8muecmAeC9e4zvrQF2X6gE5AtE7:sVQiJ6tlVeYPsYPpj+FVABQFFBf
MD5:	3D863CEBBF42DFDA1D3F4F44FB300BE6
SHA1:	AB3CBD2C8FF23F863C942A23CD150E7CDFA805BE
SHA-256:	42F96A1EE47912A91DB093AD2B4FD0676B2F7080F5843D6F691169A0B0072CB1
SHA-512:	27835A44DF1239D6DD72D267C7C8E5A86AB9612ADE8902CF397A62B52D0117D6CC9ABA0CE928F5D7DC28CA8BEC6B6E2265F39D7DB86908B64F8FF195366ED19A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369473311105966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF343b1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.061496160641729
Encrypted:	false
SSDEEP:	96:sVQqlNJ1Xb9UbtlXbRt0fYPsY5Th6Cp9/x+6M8muecmAeC9e4zvrQF2X6gE5AtE7:sVQiJ6tlVeYPsYPpj+FVABQFFBf
MD5:	3D863CEBBF42DFDA1D3F4F44FB300BE6
SHA1:	AB3CBD2C8FF23F863C942A23CD150E7CDFA805BE
SHA-256:	42F96A1EE47912A91DB093AD2B4FD0676B2F7080F5843D6F691169A0B0072CB1
SHA-512:	27835A44DF1239D6DD72D267C7C8E5A86AB9612ADE8902CF397A62B52D0117D6CC9ABA0CE928F5D7DC28CA8BEC6B6E2265F39D7DB86908B64F8FF195366ED19A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369473311105966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d1d8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.061496160641729
Encrypted:	false
SSDEEP:	96:sVQqlNJ1Xb9UbtlXbRt0fYPsY5Th6Cp9/x+6M8muecmAeC9e4zvrQF2X6gE5AtE7:sVQiJ6tlVeYPsYPpj+FVABQFFBf
MD5:	3D863CEBBF42DFDA1D3F4F44FB300BE6
SHA1:	AB3CBD2C8FF23F863C942A23CD150E7CDFA805BE
SHA-256:	42F96A1EE47912A91DB093AD2B4FD0676B2F7080F5843D6F691169A0B0072CB1
SHA-512:	27835A44DF1239D6DD72D267C7C8E5A86AB9612ADE8902CF397A62B52D0117D6CC9ABA0CE928F5D7DC28CA8BEC6B6E2265F39D7DB86908B64F8FF195366ED19A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369473311105966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558076315651454
Encrypted:	false
SSDEEP:	768:7ScC4C7pLGLvUxWPPHfTq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVabwpSrwbkp9tu/:7ScC4acvUxWPPHfTqu1javEpXbStw
MD5:	7142426AA054400A4CCB1310D2DA5B22
SHA1:	7669FA65D00E805168A29ED3EBC42878F7DF4434
SHA-256:	B60CDF0113915D422E6909A8C54216780CD3E05EE692A443B390FF56D3E38D25
SHA-512:	4F548327E8C55558ADA23F0182831990A5902D907877D0B1741D8B9E83A0DC9C9AD0333296203E00E74217EA3B0006AB9324A03FD61D39F2C34B6DF89853850B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369473310853501","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369473310853501","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF32665.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558076315651454
Encrypted:	false
SSDEEP:	768:7ScC4C7pLGLvUxWPPHfTq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVabwpSrwbkp9tu/:7ScC4acvUxWPPHfTqu1javEpXbStw
MD5:	7142426AA054400A4CCB1310D2DA5B22
SHA1:	7669FA65D00E805168A29ED3EBC42878F7DF4434
SHA-256:	B60CDF0113915D422E6909A8C54216780CD3E05EE692A443B390FF56D3E38D25
SHA-512:	4F548327E8C55558ADA23F0182831990A5902D907877D0B1741D8B9E83A0DC9C9AD0333296203E00E74217EA3B0006AB9324A03FD61D39F2C34B6DF89853850B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369473310853501","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369473310853501","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.112260144022279
Encrypted:	false
SSDEEP:	6:LTL2iOq2Pwkn23oH+TcwtrQMxIFUt80TLcFgZmw+0TLCm7kwOwkn23oH+TcwtrQq:LTLrOvYfYebCFUt80TLcC/+0TLd75Jfn
MD5:	D6F49B1166B1B8DE30FDF06A87D96113
SHA1:	7FB5D05C9B7E3D7572770A33A560AFD9E84481E9
SHA-256:	8041A97A6EFF2A181099DE46578B46180E680B5E379BDFB7DB12096304E1283A
SHA-512:	B6E8220CF5289F8C813BB728C13E4D73F5ACBB61878FCF6A63FB099C12EA877026421C65C605ECC5B937315E529ED1BCB499537C27138246C3F6B276E7C47CC9
Malicious:	false
Preview:	2024/08/30-02:35:26.942 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/30-02:35:26.944 2090 Recovering log #3.2024/08/30-02:35:26.946 2090 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.112260144022279
Encrypted:	false
SSDEEP:	6:LTL2iOq2Pwkn23oH+TcwtrQMxIFUt80TLcFgZmw+0TLCm7kwOwkn23oH+TcwtrQq:LTLrOvYfYebCFUt80TLcC/+0TLd75Jfn
MD5:	D6F49B1166B1B8DE30FDF06A87D96113
SHA1:	7FB5D05C9B7E3D7572770A33A560AFD9E84481E9
SHA-256:	8041A97A6EFF2A181099DE46578B46180E680B5E379BDFB7DB12096304E1283A
SHA-512:	B6E8220CF5289F8C813BB728C13E4D73F5ACBB61878FCF6A63FB099C12EA877026421C65C605ECC5B937315E529ED1BCB499537C27138246C3F6B276E7C47CC9
Malicious:	false
Preview:	2024/08/30-02:35:26.942 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/30-02:35:26.944 2090 Recovering log #3.2024/08/30-02:35:26.946 2090 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.107226947687109
Encrypted:	false
SSDEEP:	6:hmq2Pwkn23oH+Tcwt7Uh2ghZIFUt8KkVhZmw+KkV7kwOwkn23oH+Tcwt7Uh2gnLJ:kvYfYebIhHh2FUt8KkVh/+KkV75JfYeQ
MD5:	6A496099C1F62084266076D4D49F7D5B
SHA1:	9A235CA5A9EE615B1C231C20115CF9337C237BCF
SHA-256:	3E0D7B48FE723E2F470C732E0712D33B5A3D413644D65A4991B2808365855872
SHA-512:	35160BC795DA1C11D8890A0BDD79F28B69646D4FDA6A2050E05F9CE45B1780BE6D6EA0AA6AA0852F74168AE35CDE2759D321986D912840DAF2DFB5CF3004A9B0
Malicious:	false
Preview:	2024/08/30-02:35:11.252 2300 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/30-02:35:11.264 2300 Recovering log #3.2024/08/30-02:35:11.264 2300 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.107226947687109
Encrypted:	false
SSDEEP:	6:hmq2Pwkn23oH+Tcwt7Uh2ghZIFUt8KkVhZmw+KkV7kwOwkn23oH+Tcwt7Uh2gnLJ:kvYfYebIhHh2FUt8KkVh/+KkV75JfYeQ
MD5:	6A496099C1F62084266076D4D49F7D5B
SHA1:	9A235CA5A9EE615B1C231C20115CF9337C237BCF
SHA-256:	3E0D7B48FE723E2F470C732E0712D33B5A3D413644D65A4991B2808365855872
SHA-512:	35160BC795DA1C11D8890A0BDD79F28B69646D4FDA6A2050E05F9CE45B1780BE6D6EA0AA6AA0852F74168AE35CDE2759D321986D912840DAF2DFB5CF3004A9B0
Malicious:	false
Preview:	2024/08/30-02:35:11.252 2300 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/30-02:35:11.264 2300 Recovering log #3.2024/08/30-02:35:11.264 2300 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulR7Qu:LsGQ
MD5:	8AA0A1FA9E49AF9CEBD85BDBC480C58C
SHA1:	6E872D15FB0FEF23E11EC3D661256360390A8A76
SHA-256:	F5D0240064E52DF7EDA9DE715BCB5577D2937208F728D29FBAB8BC93340B95DC
SHA-512:	DF2D63D77A6E016480F2A7253508C5AFA864ED04136E713D6E4A9A83FBFB0A14040C2687B922AFD645431F9683FFCA8BDED3A035E77BDF323B964812ABBD56E5
Malicious:	false
Preview:	........................................%...w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlZp2kt:Ls3mk
MD5:	1CA0FD573191F683D5AD8D40356CBE2C
SHA1:	6DCD8A4A689A99D3AB9B027797389E7E37FF8EA9
SHA-256:	6FD582F7D58406EDE61E4326A5CDBCE5D48488D031187DE4B5A72F419B8546B9
SHA-512:	CA5DAF27B52EF7A59D2B9468C7DFEE7CB13FC603C70661931572DE387F132E1B67B057C06A6D62B2CB8259C2592E4DFEC000938C84F825AA4248B23FB874A717
Malicious:	false
Preview:	............................................w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.235857612155464
Encrypted:	false
SSDEEP:	6:IWPVVq2Pwkn23oH+TcwtzjqEKj3K/2jMGIFUt8RW5Zmw+RW1kwOwkn23oH+Tcwt8:RVvYfYebvqBQFUt8O/+U5JfYebvqBvJ
MD5:	D92A178E10541BF7FEA2798E99F83204
SHA1:	C0EEF21D10DABF7718A0D439301BDD4961F4C8FF
SHA-256:	D3DA03120E8A5F910261577DBE1084A552CFA9CCD520A14365CE0531A68401FE
SHA-512:	D3069BF64119C5C7DD2CCFF8574137C73C70E666ED5B5EF5F298E1FE0F9826AEADDFF017AFB168AC7A3894C79FB89ADA8951FA9A65791A49E3C1CCB926CA734C
Malicious:	false
Preview:	2024/08/30-02:35:11.730 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/30-02:35:11.731 2090 Recovering log #3.2024/08/30-02:35:11.733 2090 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.235857612155464
Encrypted:	false
SSDEEP:	6:IWPVVq2Pwkn23oH+TcwtzjqEKj3K/2jMGIFUt8RW5Zmw+RW1kwOwkn23oH+Tcwt8:RVvYfYebvqBQFUt8O/+U5JfYebvqBvJ
MD5:	D92A178E10541BF7FEA2798E99F83204
SHA1:	C0EEF21D10DABF7718A0D439301BDD4961F4C8FF
SHA-256:	D3DA03120E8A5F910261577DBE1084A552CFA9CCD520A14365CE0531A68401FE
SHA-512:	D3069BF64119C5C7DD2CCFF8574137C73C70E666ED5B5EF5F298E1FE0F9826AEADDFF017AFB168AC7A3894C79FB89ADA8951FA9A65791A49E3C1CCB926CA734C
Malicious:	false
Preview:	2024/08/30-02:35:11.730 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/30-02:35:11.731 2090 Recovering log #3.2024/08/30-02:35:11.733 2090 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0e5a657f-bfe7-4ee0-99bc-27b344bb75e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4b4f595a-ca43-4758-97ba-201b10607f9a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5371e8c5-89f1-4b13-be77-7c232c43ba6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3eade.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2d519.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fdd4789e-b602-44ab-b483-6177c3750499.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.2314763555290344
Encrypted:	false
SSDEEP:	12:LTL3AvYfYebvqBZFUt80TLmh/+0TLW+5JfYebvqBaJ:nL3yYfYebvyg8qLWLVJfYebvL
MD5:	EB7FA2D93AAA673FE2CA06A393189EAF
SHA1:	8E6A3E54D1722BCA1CB612CDE65DFEA142E1FAD1
SHA-256:	FD4912644C6569069EA14361E402F9217261F00826170789B39F94E205BE4750
SHA-512:	708EF82105602163EEB3A039D8588FA91041DA144F5ABD051AE2DEB472E179F5DF56A6ED9072B81A2F87C5F49874EAA073855B066E5B843BD4C0D022EE1C666B
Malicious:	false
Preview:	2024/08/30-02:35:26.988 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/30-02:35:26.989 2090 Recovering log #3.2024/08/30-02:35:26.993 2090 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.2314763555290344
Encrypted:	false
SSDEEP:	12:LTL3AvYfYebvqBZFUt80TLmh/+0TLW+5JfYebvqBaJ:nL3yYfYebvyg8qLWLVJfYebvL
MD5:	EB7FA2D93AAA673FE2CA06A393189EAF
SHA1:	8E6A3E54D1722BCA1CB612CDE65DFEA142E1FAD1
SHA-256:	FD4912644C6569069EA14361E402F9217261F00826170789B39F94E205BE4750
SHA-512:	708EF82105602163EEB3A039D8588FA91041DA144F5ABD051AE2DEB472E179F5DF56A6ED9072B81A2F87C5F49874EAA073855B066E5B843BD4C0D022EE1C666B
Malicious:	false
Preview:	2024/08/30-02:35:26.988 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/30-02:35:26.989 2090 Recovering log #3.2024/08/30-02:35:26.993 2090 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.194938196659363
Encrypted:	false
SSDEEP:	6:WoL+q2Pwkn23oH+TcwtpIFUt8R+1Zmw+RFlLVkwOwkn23oH+Tcwta/WLJ:WoyvYfYebmFUt8Ro/+RFlR5JfYebaUJ
MD5:	A2E23CEC1159A25E2FF4146093E55AB8
SHA1:	2F367073AD980A969C9EDCE944B858D2B0743779
SHA-256:	E13C52DD79C1D0045F8112E331479C53A4B758898670F551431CCA003557B341
SHA-512:	D024273550EDF36CEFF2AA6C0DB61D7351E188FB58F034F250253E8849DD7901E316514871007EB116888B9678F2EBB58931233F08DCF193F5555D8724CF99B7
Malicious:	false
Preview:	2024/08/30-02:35:10.856 2338 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/30-02:35:10.856 2338 Recovering log #3.2024/08/30-02:35:10.857 2338 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.194938196659363
Encrypted:	false
SSDEEP:	6:WoL+q2Pwkn23oH+TcwtpIFUt8R+1Zmw+RFlLVkwOwkn23oH+Tcwta/WLJ:WoyvYfYebmFUt8Ro/+RFlR5JfYebaUJ
MD5:	A2E23CEC1159A25E2FF4146093E55AB8
SHA1:	2F367073AD980A969C9EDCE944B858D2B0743779
SHA-256:	E13C52DD79C1D0045F8112E331479C53A4B758898670F551431CCA003557B341
SHA-512:	D024273550EDF36CEFF2AA6C0DB61D7351E188FB58F034F250253E8849DD7901E316514871007EB116888B9678F2EBB58931233F08DCF193F5555D8724CF99B7
Malicious:	false
Preview:	2024/08/30-02:35:10.856 2338 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/30-02:35:10.856 2338 Recovering log #3.2024/08/30-02:35:10.857 2338 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:SJl1lhtlA+:M3r
MD5:	1D2A37C4456FAC616C06362B1B17EE63
SHA1:	1DBFE5DA178778D16A8AF2301DFA618866A4CA27
SHA-256:	3B1FDC0468B57CDD881BCD9E93415AB853B52E42D337BC67037CA1E82393DEBD
SHA-512:	27C56EC33E7B03A2EAF3EE094168589D65F668E42457CF0163253719AE041B65C5C64A9089709697F3001CC3BC2674DBFB8B1101091F9B702C94C72E099DBFFC
Malicious:	false
Preview:	..................W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ba58ecbe-863e-4f2c-8ed9-50dfd86212d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9297
Entropy (8bit):	5.1714427895267825
Encrypted:	false
SSDEEP:	96:sVQqlNJ1Xb9UbtlXbRt05GRa1adYPsY5Th6Cp9/x+6M8muecmAeCgAe4zvrQF2Xo:sVQiJ6tlV/kadYPsYPpj+FVAZQFFBf
MD5:	A82B771396066CF89804EA54252E47E8
SHA1:	D9965D350E37D14D3750A6A3D20AF4539EADEC46
SHA-256:	57C403893891D775EA47BF7DCBFA193D369C8C373CEDC21EB9799D913FEC0BD9
SHA-512:	814C3D2F8802C36775E39735CDACE6866784BB3D608BF25FA944229A1422251EE4DF6A935CF2BAD10A236BD7345E94BECA67280349E9FC5F4ACB2D0CD279593E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369473311105966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d2880c6b-eaeb-4bfc-a94f-4ca4fff46cfa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.29193989140738
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQFll3seGKT9rcQ6xEQyOtlTxotl:/XntM+Sll3sedhO5yOu
MD5:	29001471F9E0A5FDB727BA32D70C7D20
SHA1:	9B4B9A7C1F5CCFB9CB2191C84E9A26D45A703DE5
SHA-256:	A9CF5D54D35A6F28979716A661EA8F0C8B87B59362833B845620E9F277A09B3A
SHA-512:	A9DB3120FF9DD5440D14586829A799C3459951F8A7457A12CAD4F68BC3010805FF5CE244C83C68AB37016CA152FA75C1AB7D97370A07F743B54C40C2E97F97EE
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..G.0................39_config..........6.....n ...1u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.204855648733549
Encrypted:	false
SSDEEP:	6:OHI+q1wkn23oH+Tcwtfrl2KLlgWjpIq2Pwkn23oH+TcwtfrK+IFUv:OHI+1fYeb1L2Wj6vYfYeb23FUv
MD5:	1016F6B816DE6E8F9CDC8C8E0DDA1CEE
SHA1:	EFCF23E075E3433958A67840F25342C74B3D2B30
SHA-256:	12C5A744663FBC5D2A1D46ABE0AAB3915A3939FBB828045D3F23F3F818373F1B
SHA-512:	64A0E5529BFEF38C394A72DD676EC4E678ADC27A9DD1F063B0BC18DB5FB07AFB2E11893332DB96C6C7F943BF4C84D5D8CECE771CD22F6C535AC2FBD88693BC75
Malicious:	false
Preview:	2024/08/30-02:35:11.122 2340 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/30-02:35:11.137 2340 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	646
Entropy (8bit):	3.916543429071092
Encrypted:	false
SSDEEP:	12:G0nYUtTNVdZ5zD/7bEXZmh/U/9Y+chRc9FkwQ/:G0nYUtP35zDjomhCe+caQ/
MD5:	48281860D3D5F4FBE4E92046D2061996
SHA1:	1A8B903654468A5105657C583023089153AD7758
SHA-256:	D389F4679C7EA1EF5DAC8FFCF43C23FDDBDD750A61E5049ABFA61C32AE361ED3
SHA-512:	4D7FC5FD09252EDB23FB37F89485330910C22F9D478CB34E08BD55C4023DAE35CC0A3CB4E82CE190AC7665E0206C22B5C295CAC2BE3FA00DDD70740A417EB0D0
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....'...................20_.......T=.................19_.....*...................18_........a.................37_......x...................38_........i.................39_.........................20_........].................20_.....{a...................19_.....f.F..................18_.......\|.................37_.......&B.................38_........D.................39_..........................9_.....3V.~.................9_....... ..................21_.....p....................21_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.167815571478957
Encrypted:	false
SSDEEP:	6:O7lq1wkn23oH+Tcwtfrzs52KLlgU2X2Iq2Pwkn23oH+TcwtfrzAdIFUv:O7l1fYebs9L2tvYfYeb9FUv
MD5:	45855BD817642C3C1DEDCCDB6871DFFD
SHA1:	50BEA052EF1470173252D5A1E638ECCA7B70051C
SHA-256:	E3B11EE03CA5191DC30167CCA2AE153C0EA7CF1954A55FF096B6034CA16BC8B9
SHA-512:	5A5F062CDC154B21759371F250AAC9FC550C5D01A63F1E28CF6F57B04DC50FBB4B2284B0DF4BAE4F2234FAA167A87D22997B1A419B4BD5BD6B6E2E389629D00B
Malicious:	false
Preview:	2024/08/30-02:35:11.104 2340 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/30-02:35:11.117 2340 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlopKl/:Ls3i+
MD5:	679CABDAF60390EF6C6F852F3E0C9AAB
SHA1:	E76969383001D87498497439E467721CDF09FF32
SHA-256:	E032CAB737186220A0FC13FB81C5EA63AE682B79DFA0F518C87FACB93648DA9D
SHA-512:	8A3305651D5E8D127E3F44375F7D70132ACB859D996502EC7F30A7CDE005ECED6AE94BF3C78AE85B97542CC22DB79779BDE9D33EBBAB5F8E3472668F16499DC5
Malicious:	false
Preview:	.........................................m..w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlqu:Ls3
MD5:	95C12970967364226D741A5FB1F0E469
SHA1:	286CC07D86AC9501EDB99FFBB41CFB70C2670B0F
SHA-256:	6D303C5DE1D19A35112A473895408118087B23A5B4DDE7708F6642C1D1F57077
SHA-512:	454E7A1D1397EC2B5ED28956B462ABA7923B6C06F9E3E3941849CA39694F63CD8FE211259DA349B5C270B0C432E1ED8B2A7902E2E37CFB68E52A322D71E1E165
Malicious:	false
Preview:	.........................................&..w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c114.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c133.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e219.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e238.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e276.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30253.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30262.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF336e0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF336ef.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3aa99.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d1c8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF420d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.788873322031055
Encrypted:	false
SSDEEP:	96:iaqkHflZZq5ih/cI9URLl8RotoXMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aktHeiRUohD6qRAq1k8SPxVLZ7VTiq
MD5:	DA0472C529795E615D4AADADC05C185E
SHA1:	AE62DFC549FAB464D72BF5E0FA4CC2AEE28D8C38
SHA-256:	D0253F8C9EEDF49DE1BD2C932FDB55D06BF833ABF655DA5B0AD48DD45A2B8E9F
SHA-512:	9AB9647B368422E4AD7D11E02012AF010AA65EC2E5F9D0639614B82D40F3EDBA34BD3DBB92540EFE6A1E4945F117579734D26CA83ACD15B62937CFCB7F3C1671
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAhnalOwDoUQ5XxQcggcQ9NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADiznvhahFwc99vOceGypa61pOGWEoht+iQtIwVmCinwwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlOpl:Ls3O
MD5:	F441FBEA6F98C5292407D930C3E8F677
SHA1:	5D37D9E68BDB2D4EFDB01B68944E56793035AFA0
SHA-256:	6D0E00E411000AB25157E356A7DE65FC6123BD8D1EAB6E78D36A149ED9D2A54A
SHA-512:	DD2CE7E7F726BFA2A1BAA520F36CB1E097F3FFF9F645F04CB50699EA366A074E61B27853A59A8822472F841631188D984D03E86C8CE415B7B1AA8EC496BE5AD3
Malicious:	false
Preview:	........................................./..w./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d903a38c-43b8-4731-9783-c4bbf1537469.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	59891
Entropy (8bit):	6.0811807989121
Encrypted:	false
SSDEEP:	1536:uMGQ5XMBG0af8dP0SAj0dOb8q1TjHBNzGGn:uMrJM8VkdP0SAI08O5NzGGn
MD5:	8845B0FB685362FEB5FCFAD35D7B26B8
SHA1:	A97EFECD04DC3C9EC95A94FEA88CEB08DC086DD7
SHA-256:	9AB403A7B4DFD955CAA3269EFB1A7E2B6E3557424584FDCFAEEB84B4E4647C5B
SHA-512:	683292B0A662F1D61BC981A28C716A18BBB4FE10D0A65B21A8FEF29B08FA769A52CB2DC05BA7375B1953317CBBF13E2A5D943010FD806611B00D9764E2DC324F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369473311111549","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e46126e3-5fe2-4e38-8d7c-acf8754d59ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.058096620474525
Encrypted:	false
SSDEEP:	384:KtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwQO+v1O+Mh0lkdHd5q8:uMGQ7FCYXGIgtDAWtJ4nL+v1Gh02tdP
MD5:	A0F9453C1EB6FEDC2E4BE291998B4BE9
SHA1:	8EF1E9CB7C5FF13072DE0DB59685E9AFD4A567A5
SHA-256:	D93A6151943FEBF57AF906048D6094690F4DD649F27FEF5AEE556FB7004C3805
SHA-512:	15D632CAD507B38FA464FBB5BAF19AB3AF5CA31F27FBF73E009C35C6BBFB7A95C392F829FD050952F9281F8B4C8BD32F724E22AB4378C8A217F7C32371AF1245
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369473311111549","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fa41e1ad-2485-460e-b130-7572723f37ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.829227272462731
Encrypted:	false
SSDEEP:	192:fsNwtdeiRUpc13Q5Pyik1+96qRAq1k8SPxVLZ7VTiB:fsNwfYcg5qh1+96q3QxVNZTiB
MD5:	98F3320AF6EECE9C9B57A83094A57C4F
SHA1:	7ED33109C22E0395C5A5E328898D21FB705EC63C
SHA-256:	A6C7E2383DEB5D086108750526D581EA8DCB30DEB909E8B45FDA006412D1F07C
SHA-512:	96405CCF364FB17D53E7C9C0E2F3D3B95A7F36FF3842EACC9A83B8529A36189EE25D0443FF67E24CA83CABE7393917D808549E0CE3BDFB40EFCE235F6E5161A0
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8472197930129193
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxqxl9Il8uf1UvlbErH0OOvyCXibd1rc:mTYZavlbIUOOhXi8
MD5:	BE45A062188CF02E16EF16787CDCF770
SHA1:	F196BC91A60E55445149FDAA33CB13753A31E79A
SHA-256:	47951F8CA418407354280530597A5843E333A4C5BA16736A82042D3D034C3E97
SHA-512:	D5EC68F3BBB964DF137BED8C738D690EB27987942E07082882A3723AEF10FCDA78BDEAE00D34B5F96EFF4D83D040808891C8D63EFA375741433C13A725191AA3
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.H.1.h.H.a./.6.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.Z.2.p.T.s.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001672837336347
Encrypted:	false
SSDEEP:	48:uiTrlKxExAUMxD9Il8ufR8E5udo4l60BHXxKL2D1Mk2vn7o7iAuDozXNkWLHExN6:8UCYZRpK1l60dsn7EiApnURa9
MD5:	320A20368C482EDD6CE011389DD09970
SHA1:	AA8A23DED01A39F3682C61606D4273730CF782B9
SHA-256:	3986F336BD71251DB3D32647B8C790E6E8F79FE4D7F6E9BB70C06D3417A0FEE2
SHA-512:	3E01C70B440463F7AA664259B71FB1A200E74C37960A5C7147F42F2FAA662CF03217E94E7D67B34435F849AF9139FA413CA31C2704344A9E98D5141C9154BBDC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".T.C.q.e.A.6.f.6.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.Z.2.p.T.s.

C:\Users\user\AppData\Local\Temp\11d8e933-3a75-41c3-8532-c3cbe7f9a714.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\5198af61-89bd-4da0-82d6-de60016426f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\94c69b54-6136-4a36-9c8b-98c7d706a277.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.366931094301839
Encrypted:	false
SSDEEP:	12:YpBSJ0Dkv/PdSE56s/PdDOCVrT0Dkv/P63Yu56s/C:YpBSJ08dD5xdyWH086ou5M
MD5:	00746081DA2C6DCCFDF86B3310EC4C1D
SHA1:	AC153215B686CDE8F18DCF8F6E773D1FB129C118
SHA-256:	6ABDE53E9C108FE6CA28BA1BE67133F29CF012141D338DCDE51E7E6BF061F451
SHA-512:	7A558443D5032326D6D8A2273E03534CFBCCCE706B4CEF9747E33A3F89523D26705777308E2CA835543A809B1ABED541A0C1BCFD69F97F6C6201A347804E21C3
Malicious:	false
Preview:	{"logTime": "0830/063501", "correlationVector":"7E30C585E5644F1A8A42FA5983C3A1E4","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0830/063512", "correlationVector":"CKsUwpJRkPsiTdPQXuK+ON","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0830/063512", "correlationVector":"761CB90D6DDB464D8D102C3857FE5C76","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0830/063513", "correlationVector":"9a7cw9emBvA17vBlU8Bzb9","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\f6ec7d4a-dfb7-4034-85dd-703074bbb33d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\5198af61-89bd-4da0-82d6-de60016426f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8848_1627783918\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir8848_914835161\11d8e933-3a75-41c3-8532-c3cbe7f9a714.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8848_914835161\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8848_914835161\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8848_914835161\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8848_914835161\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1K5L88MSB7R10O8FF5LJ.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5050006000912735
Encrypted:	false
SSDEEP:	48:0EZPdO3zGIfasJlU0r4zBdLXuHokDpW2AZPdO3zGIfasJlU0r4zngdLXuHok+21:Nl3uIkD9wlnIuIkz
MD5:	45CA03D9FE8224DC3741BD6804BC3B18
SHA1:	B8EFDD95E1E564F14160BB649CEE85FE02182AA4
SHA-256:	506C10BAAF2572FFEF2ED006D3F85895347135FF716132295C05F56E2B46A663
SHA-512:	9B82AB2AB86C088DE8B54AD91683365D145213FA495A8C84D37EF2F576B485A52D9A90662C8BABC4B031EDDD6855604B912CCEBBCDCBAD2025E398FDD2747F3E
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....M......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......YZ4..PROGRA~2.........O.I.YZ4....................V......o..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y\4..........................P+..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Ya4...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y\4..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y\4....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............(......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5094376189336773
Encrypted:	false
SSDEEP:	48:0Et4dO3zGWfasJlU0r4zBdLXuHokDpW2AZPdO3zGIfasJlU0r4zngdLXuHok+21:Cl3uIkD9wlnIuIkz
MD5:	D76B6BF0516E0F8BF457E4DFB0455DE2
SHA1:	98CB12A041CF18A85DAFB2A8B9D667F2C3F50174
SHA-256:	30CF4FC903732DF0828553118FA69E7AD16A7F10BB14B00927146002DF19C8AD
SHA-512:	5153D16A55BC156458BCF1A74E3A7790683CE3AFC5B53EBF70EB7EDADD2F8F92260D8A9259F222D07F458480301EC8641CAB85C0ED86F1C84F82C9C474B984B1
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....M......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V.....".X.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y\4..........................P+..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y\4..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y\4....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............(......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FBMJVVWS8KF5K1MH5DY4.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5094376189336773
Encrypted:	false
SSDEEP:	48:0Et4dO3zGWfasJlU0r4zBdLXuHokDpW2AZPdO3zGIfasJlU0r4zngdLXuHok+21:Cl3uIkD9wlnIuIkz
MD5:	D76B6BF0516E0F8BF457E4DFB0455DE2
SHA1:	98CB12A041CF18A85DAFB2A8B9D667F2C3F50174
SHA-256:	30CF4FC903732DF0828553118FA69E7AD16A7F10BB14B00927146002DF19C8AD
SHA-512:	5153D16A55BC156458BCF1A74E3A7790683CE3AFC5B53EBF70EB7EDADD2F8F92260D8A9259F222D07F458480301EC8641CAB85C0ED86F1C84F82C9C474B984B1
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....M......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V.....".X.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y\4..........................P+..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y\4..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y\4....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............(......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5050006000912735
Encrypted:	false
SSDEEP:	48:0EZPdO3zGIfasJlU0r4zBdLXuHokDpW2AZPdO3zGIfasJlU0r4zngdLXuHok+21:Nl3uIkD9wlnIuIkz
MD5:	45CA03D9FE8224DC3741BD6804BC3B18
SHA1:	B8EFDD95E1E564F14160BB649CEE85FE02182AA4
SHA-256:	506C10BAAF2572FFEF2ED006D3F85895347135FF716132295C05F56E2B46A663
SHA-512:	9B82AB2AB86C088DE8B54AD91683365D145213FA495A8C84D37EF2F576B485A52D9A90662C8BABC4B031EDDD6855604B912CCEBBCDCBAD2025E398FDD2747F3E
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....M......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......YZ4..PROGRA~2.........O.I.YZ4....................V......o..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y\4..........................P+..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Ya4...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y\4..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y\4....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............(......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.57975974035576
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	f7d0bcf3675717c5157e215474ea4b5b
SHA1:	16282144ef49ecb4f788c9b2e2a641ec0b5e8917
SHA256:	bf404a32bc8915774c6653217952c2f8af53e30685823de207277f5211909b8e
SHA512:	4c0459ee05268918e4194781141028e0275637fb97e64ce3140689a50b1d22dd764a9486c763d1e3557e4acae0ca83103fbb4925eab3956c3bd6b85db94d0d1f
SSDEEP:	12288:LqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTb:LqDEvCTbMWu7rQYlBQcBiT6rprG8asb
TLSH:	00159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D164C2 [Fri Aug 30 06:20:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FC789169763h
jmp 00007FC78916906Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC78916924Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC78916921Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FC78916BE0Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FC78916BE58h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FC78916BE41h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	491e1aa6ecfee99cb4af8375cbcfd8f6	False	0.28705729166666666	data	5.165849846282447	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2024 08:34:51.097043991 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 30, 2024 08:35:00.848124981 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 30, 2024 08:35:01.889179945 CEST	49746	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.889218092 CEST	443	49746	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:01.889288902 CEST	49746	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.889523983 CEST	49747	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.889549971 CEST	443	49747	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:01.889625072 CEST	49747	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.889904976 CEST	49746	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.889920950 CEST	443	49746	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:01.890073061 CEST	49747	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.890086889 CEST	443	49747	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:01.890439034 CEST	49748	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.890446901 CEST	443	49748	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:01.890491962 CEST	49748	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.890904903 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.890913010 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:01.890986919 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.891042948 CEST	49748	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.891057968 CEST	443	49748	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:01.891176939 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:01.891189098 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:01.954070091 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:01.954085112 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:01.954194069 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:01.955056906 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:01.955069065 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:02.347093105 CEST	443	49747	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.347502947 CEST	49747	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.347513914 CEST	443	49747	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.348365068 CEST	443	49747	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.348437071 CEST	49747	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.349678040 CEST	49747	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.349735975 CEST	443	49747	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.349811077 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.349885941 CEST	49747	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.349891901 CEST	443	49747	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.350332022 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.350339890 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.351224899 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.351279974 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.352353096 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.352415085 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.352572918 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.352580070 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.361222982 CEST	443	49746	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.361440897 CEST	49746	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.361460924 CEST	443	49746	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.362462997 CEST	443	49746	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.362535000 CEST	49746	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.362634897 CEST	443	49748	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.363430977 CEST	49748	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.363442898 CEST	443	49748	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.363590956 CEST	49746	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.363642931 CEST	443	49746	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.363800049 CEST	49746	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.363807917 CEST	443	49746	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.364306927 CEST	443	49748	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.364367962 CEST	49748	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.365201950 CEST	49748	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.365258932 CEST	443	49748	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.365387917 CEST	49748	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.365395069 CEST	443	49748	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.410501957 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:02.411007881 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:02.411015034 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:02.412064075 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:02.412156105 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:02.412501097 CEST	49746	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.412592888 CEST	49748	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.413347006 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:02.413409948 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:02.413521051 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:02.413525105 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:02.415798903 CEST	49747	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.415823936 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.457834959 CEST	443	49747	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.458242893 CEST	443	49747	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.458308935 CEST	49747	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.458496094 CEST	49747	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.458511114 CEST	443	49747	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.472266912 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.472315073 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.472413063 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.472701073 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.472708941 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.505763054 CEST	443	49746	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.505806923 CEST	443	49746	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.506020069 CEST	49746	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.506216049 CEST	49746	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.506226063 CEST	443	49746	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.507847071 CEST	443	49748	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.507884979 CEST	443	49748	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.507930994 CEST	49748	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.509140968 CEST	49748	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.509146929 CEST	443	49748	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.521965981 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:02.527748108 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:02.527859926 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:02.527918100 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:02.528394938 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:02.528403997 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:02.586262941 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.586299896 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.586358070 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.586554050 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.586563110 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.586656094 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.586890936 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.586904049 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.588681936 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.588699102 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.943954945 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.943984032 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.944071054 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.944278002 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.944303989 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.944468975 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.945336103 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.945350885 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.945547104 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.945558071 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.977883101 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.977895021 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.978007078 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.978252888 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.978259087 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.978312016 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.978533983 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.978548050 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.978638887 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.978650093 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.980624914 CEST	49759	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.980642080 CEST	443	49759	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.980695009 CEST	49759	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.981390953 CEST	49760	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.981421947 CEST	443	49760	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.981483936 CEST	49760	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.981717110 CEST	49759	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.981729031 CEST	443	49759	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:02.981940031 CEST	49760	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.981950998 CEST	443	49760	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.049623966 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.050628901 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.050641060 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.050921917 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.051486969 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.051542997 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.072072029 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.072774887 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.072788000 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.073108912 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.074486971 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.074546099 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.102338076 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.118103027 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.137579918 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.137609005 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.137674093 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.137830973 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.137845039 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.146625042 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.146656990 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.146711111 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.147000074 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.147032022 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.147082090 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.147342920 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.147356033 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.147869110 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.147881985 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.394787073 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.404541969 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.404568911 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.404861927 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.412498951 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.412561893 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.426815987 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.433424950 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.434792042 CEST	443	49760	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.435472012 CEST	443	49759	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.436347008 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.454958916 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.468159914 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.468178988 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.468435049 CEST	49759	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.468445063 CEST	443	49759	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.468619108 CEST	49760	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.468636990 CEST	443	49760	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.468718052 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.468725920 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.469044924 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.469050884 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.469078064 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.469136953 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.469336987 CEST	443	49759	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.469397068 CEST	49759	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.469531059 CEST	443	49760	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.469589949 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.469590902 CEST	49760	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.469608068 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.469659090 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.478110075 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.478168964 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.479213953 CEST	49759	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.479271889 CEST	443	49759	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.480896950 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.480953932 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.481226921 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.481313944 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.481473923 CEST	49760	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.481523991 CEST	443	49760	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.520067930 CEST	49765	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.520096064 CEST	443	49765	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.520278931 CEST	49766	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.520288944 CEST	443	49766	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.520313025 CEST	49765	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.520339012 CEST	49766	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.520561934 CEST	49767	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.520579100 CEST	443	49767	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.520627975 CEST	49767	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.520780087 CEST	49765	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.520792961 CEST	443	49765	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.520962000 CEST	49766	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.520972967 CEST	443	49766	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.521096945 CEST	49767	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.521109104 CEST	443	49767	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.532798052 CEST	49759	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.532807112 CEST	443	49759	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.532840014 CEST	49760	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.532846928 CEST	443	49760	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.579677105 CEST	49759	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.579732895 CEST	49760	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.598402023 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:03.598437071 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:03.598576069 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:03.600508928 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:03.600524902 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:03.626568079 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.626568079 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.626568079 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.626581907 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.626595974 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.723767996 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.724560976 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.724574089 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.726016998 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.726082087 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.731947899 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.732031107 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.732378006 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.732387066 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.783345938 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.783636093 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.783653021 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.784832001 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.784900904 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.785944939 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.786021948 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.786134005 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.786139011 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.792809963 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.793164968 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.793184042 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.794061899 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.794121027 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.794387102 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.794440985 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.794513941 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.794523954 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.799431086 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.799500942 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.799504042 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.844577074 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.844600916 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.844650030 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.844657898 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.844691038 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.844870090 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.845300913 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.845757008 CEST	49761	443	192.168.2.4	20.96.153.111
Aug 30, 2024 08:35:03.845769882 CEST	443	49761	20.96.153.111	192.168.2.4
Aug 30, 2024 08:35:03.882642031 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.882687092 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.882742882 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.882760048 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.882788897 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.882810116 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.882952929 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.883085012 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.883131981 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.884824038 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.884838104 CEST	443	49763	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.884846926 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.885078907 CEST	49763	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.904025078 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.904042959 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.904048920 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.904086113 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.904108047 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.904119015 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.904128075 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.904139996 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.904164076 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.976413965 CEST	443	49765	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.976636887 CEST	49765	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.976650000 CEST	443	49765	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.976939917 CEST	443	49765	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.977262974 CEST	49765	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.977315903 CEST	443	49765	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.977999926 CEST	443	49767	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.978205919 CEST	49767	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.978220940 CEST	443	49767	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.979144096 CEST	443	49767	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.979203939 CEST	49767	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.979300022 CEST	443	49766	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.979516029 CEST	49767	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.979568958 CEST	443	49767	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.979675055 CEST	49766	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.979685068 CEST	443	49766	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.980003119 CEST	443	49766	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.980421066 CEST	49766	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.980539083 CEST	443	49766	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.986207962 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.986223936 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.986265898 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.986272097 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.986311913 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.986334085 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.988368988 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.988388062 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.988440037 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:03.988451958 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:03.988500118 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:04.032803059 CEST	49767	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.032814980 CEST	443	49767	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.073846102 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:04.073867083 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:04.073929071 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:04.073940992 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:04.073971033 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:04.073996067 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:04.074018002 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:04.074069023 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:04.074076891 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:04.074125051 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:04.074215889 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:04.075361967 CEST	49762	443	192.168.2.4	13.107.246.40
Aug 30, 2024 08:35:04.075375080 CEST	443	49762	13.107.246.40	192.168.2.4
Aug 30, 2024 08:35:04.083491087 CEST	49767	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.128427029 CEST	49765	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.128427029 CEST	49766	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.260340929 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:04.260412931 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:04.266243935 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:04.266262054 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:04.266478062 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:04.315196037 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:04.362200975 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:04.404503107 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:04.551419020 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:04.551476002 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:04.551582098 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:04.558737040 CEST	49768	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:04.558751106 CEST	443	49768	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:04.733316898 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:04.733355999 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:04.733457088 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:04.733464956 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:04.733489990 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:04.733520031 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:04.733961105 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:04.733973026 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:04.734100103 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:04.734106064 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:04.850236893 CEST	49771	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:04.850263119 CEST	443	49771	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:04.850333929 CEST	49771	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:04.851128101 CEST	49771	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:04.851141930 CEST	443	49771	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:05.030385971 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.030443907 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.030514002 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.030806065 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.030817032 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.197607040 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.198718071 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.198746920 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.199130058 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.199204922 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.199839115 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.199902058 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.211939096 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.212011099 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.215487003 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.215500116 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.221194029 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.256479979 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.271395922 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.277605057 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.277620077 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.278315067 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.278381109 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.279321909 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.279387951 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.279565096 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.279647112 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.280834913 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.280842066 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.321656942 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.322742939 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.322875977 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.325093031 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.393364906 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.393619061 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.393796921 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.447978973 CEST	49770	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.448007107 CEST	443	49770	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.448992968 CEST	49769	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.448998928 CEST	443	49769	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.493482113 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.507383108 CEST	443	49771	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:05.507461071 CEST	49771	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:05.507791042 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.507803917 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.508822918 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.508878946 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.511703968 CEST	49771	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:05.511713982 CEST	443	49771	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:05.511946917 CEST	443	49771	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:05.514426947 CEST	49771	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:05.516299963 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.516385078 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.516473055 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.516484976 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.556510925 CEST	443	49771	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:05.580416918 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.611741066 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.611783981 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.611816883 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.611849070 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.611859083 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.611870050 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.611916065 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.611923933 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.611939907 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.611959934 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.611988068 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.613327980 CEST	49772	443	192.168.2.4	142.251.32.100
Aug 30, 2024 08:35:05.613338947 CEST	443	49772	142.251.32.100	192.168.2.4
Aug 30, 2024 08:35:05.754599094 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.754627943 CEST	443	49773	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.754823923 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.754930973 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.754937887 CEST	443	49774	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.754990101 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.755167007 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.755175114 CEST	443	49773	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.755314112 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.755321026 CEST	443	49774	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.787658930 CEST	443	49771	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:05.787713051 CEST	443	49771	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:05.787765980 CEST	49771	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:05.788450003 CEST	49771	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:05.788461924 CEST	443	49771	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:05.788475037 CEST	49771	443	192.168.2.4	184.28.90.27
Aug 30, 2024 08:35:05.788479090 CEST	443	49771	184.28.90.27	192.168.2.4
Aug 30, 2024 08:35:06.217716932 CEST	443	49773	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.217977047 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.217987061 CEST	443	49773	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.218305111 CEST	443	49773	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.218367100 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.218919039 CEST	443	49773	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.218970060 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.219162941 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.219211102 CEST	443	49773	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.220346928 CEST	443	49774	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.220519066 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.220525026 CEST	443	49774	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.220841885 CEST	443	49774	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.220901966 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.221446991 CEST	443	49774	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.221498966 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.221697092 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.221745968 CEST	443	49774	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.375864029 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.375874996 CEST	443	49773	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.375906944 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.375910997 CEST	443	49774	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.509185076 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.509247065 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:13.419699907 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:13.419725895 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:13.419811964 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:13.421525955 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:13.421540022 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:13.472085953 CEST	49672	443	192.168.2.4	173.222.162.32
Aug 30, 2024 08:35:13.472126007 CEST	443	49672	173.222.162.32	192.168.2.4
Aug 30, 2024 08:35:13.939572096 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:13.939585924 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:13.939677000 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:13.941168070 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:13.941179037 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:13.970768929 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:13.970782042 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:13.970875978 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:13.972206116 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:13.972217083 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:14.014672995 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:14.014754057 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:14.017206907 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:14.017214060 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:14.017420053 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:14.079912901 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:15.293628931 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.293983936 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.294001102 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.294522047 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.294538021 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.294600010 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.294606924 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.294639111 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.294651985 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.295272112 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:15.295530081 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.296889067 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.297032118 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.297147036 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.297152996 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.336541891 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.392738104 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.470416069 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.470628023 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.470638037 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.471487045 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.471554041 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.472553015 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.472610950 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.472723961 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.472731113 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.490483046 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.490503073 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.490509987 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.490536928 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.490550995 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.490559101 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.490581989 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:15.490597963 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.490641117 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:15.490641117 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:15.490824938 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.490883112 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:15.490890026 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.491338968 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:15.491429090 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:15.548960924 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.558176994 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.558284044 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.558335066 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.558346987 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.560878038 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.560936928 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.560944080 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.567064047 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.567121029 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.567126989 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.572243929 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.572266102 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.572273970 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.572297096 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.572305918 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.572318077 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.572321892 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.572335005 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.572369099 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.572381973 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.572783947 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.572820902 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.572912931 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.573394060 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.573441982 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.573452950 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.574098110 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.574107885 CEST	443	49784	13.107.246.67	192.168.2.4
Aug 30, 2024 08:35:15.574136972 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.574152946 CEST	49784	443	192.168.2.4	13.107.246.67
Aug 30, 2024 08:35:15.579678059 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.579735994 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.579741955 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.585937023 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.586158037 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.586164951 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.592237949 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.592288017 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.592293978 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.598499060 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.598546028 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.598551035 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.646260023 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.646307945 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.646315098 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.647203922 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.647284985 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.647290945 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.653644085 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.653697968 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.653703928 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.660005093 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.660718918 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.660726070 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.666132927 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.666196108 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.666201115 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.672446012 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.672502995 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.672509909 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.678906918 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.678992033 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.679003954 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.685142040 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.685190916 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.685199022 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.692879915 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.692954063 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.692965031 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.697267056 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.697329044 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.697336912 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.702754021 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.702842951 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.702851057 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.708579063 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.708626032 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.708632946 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.713550091 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.713593960 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.713599920 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.719033957 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.719090939 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.719096899 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.724535942 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.724589109 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.724595070 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.730174065 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.730225086 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.730231047 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.735537052 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.735780001 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.735785961 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.739368916 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.739423037 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.739428997 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.743347883 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.743423939 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.743434906 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.746932030 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.747004032 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.747009039 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.750626087 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.750689030 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.750695944 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.754328966 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.754379034 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.754384041 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.757546902 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.757647991 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.757653952 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.761250973 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.761337042 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.761343002 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.764513969 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.764720917 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.764725924 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.768033981 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.768079996 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.768085957 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.771753073 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.771799088 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.771805048 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.775185108 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.775280952 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.775289059 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.778489113 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.778529882 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.778536081 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.793381929 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.793425083 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.793479919 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.793479919 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.793493986 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.793521881 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.793998957 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.794034958 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.794073105 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.794075966 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.794086933 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.794107914 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.796031952 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.796083927 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.796088934 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.799357891 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.799415112 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.799421072 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.802870989 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.803061008 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.803066015 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.806171894 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.806216955 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.806222916 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.809499979 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.809572935 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.809578896 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.812839031 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.812884092 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.812890053 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.815861940 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.815910101 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.815915108 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.819061995 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.819118977 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.819123030 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.822011948 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.822066069 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.822071075 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.822165966 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.822173119 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.822196960 CEST	443	49783	142.250.185.161	192.168.2.4
Aug 30, 2024 08:35:15.822232962 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:15.822252989 CEST	49783	443	192.168.2.4	142.250.185.161
Aug 30, 2024 08:35:16.012276888 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:16.012299061 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:16.012309074 CEST	49781	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:16.012326002 CEST	443	49781	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:17.445447922 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:17.445472002 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.445542097 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:17.445966005 CEST	49792	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.446017027 CEST	443	49792	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.446106911 CEST	49792	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.446258068 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:17.446270943 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.446382999 CEST	49792	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.446412086 CEST	443	49792	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.499774933 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.499811888 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.500009060 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.500597954 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.500612974 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.913928986 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.914166927 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:17.914182901 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.915199995 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.915270090 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:17.915676117 CEST	443	49792	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.915967941 CEST	49792	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.915992975 CEST	443	49792	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.916296959 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:17.916351080 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.916507959 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:17.916515112 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.919576883 CEST	443	49792	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.919646025 CEST	49792	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.920501947 CEST	49792	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.920578003 CEST	443	49792	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.920682907 CEST	49792	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.958100080 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.958157063 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.958244085 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:17.961683035 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.961929083 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.961947918 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.962924004 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.963130951 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.963917017 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.963973999 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.964106083 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.964112043 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.964510918 CEST	443	49792	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:17.978279114 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.978331089 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:17.978379965 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:17.985552073 CEST	49792	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:17.985560894 CEST	443	49792	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:18.048257113 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:18.048259974 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:18.052005053 CEST	443	49792	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:18.052064896 CEST	49792	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:18.052303076 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.052366972 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.052418947 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:18.052495003 CEST	49792	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:18.052509069 CEST	443	49792	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:18.052908897 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:18.052933931 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.098368883 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:18.098408937 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:18.098455906 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:18.098819971 CEST	49793	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:18.098829031 CEST	443	49793	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:18.307200909 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.307260990 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.307334900 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:18.331296921 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.331356049 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.331490993 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:18.343897104 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.343954086 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.344000101 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:18.346137047 CEST	443	49760	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.346184969 CEST	443	49760	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.346246958 CEST	49760	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:18.346527100 CEST	443	49759	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.346581936 CEST	443	49759	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.346642017 CEST	49759	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:18.346982002 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.347028971 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:18.347074986 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:32.895919085 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:32.895968914 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:32.896028996 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:32.896272898 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:32.896316051 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:32.896367073 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:32.896440983 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:32.896460056 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:32.896545887 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:32.896563053 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.351167917 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.367798090 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.381406069 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.381431103 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.381923914 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.383348942 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.383371115 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.383761883 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.384073973 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.384166956 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.385970116 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.386080980 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.439372063 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.439443111 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.503817081 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:33.503844976 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:33.503963947 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:33.504121065 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:33.504134893 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.084775925 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.085202932 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:34.085222960 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.086077929 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.086226940 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:34.087584972 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:34.087584972 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:34.087604046 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.087645054 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.127403021 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:34.127413034 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.175301075 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:34.191210032 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.192327976 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.192337036 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.192358971 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.192367077 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.192419052 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.192445993 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:34.192445993 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:34.192634106 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:34.193089962 CEST	49796	443	192.168.2.4	152.195.19.97
Aug 30, 2024 08:35:34.193103075 CEST	443	49796	152.195.19.97	192.168.2.4
Aug 30, 2024 08:35:34.502945900 CEST	49797	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.502981901 CEST	443	49797	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.503168106 CEST	49797	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.503467083 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.503473997 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.503513098 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.504182100 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.504198074 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.504411936 CEST	49797	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.504422903 CEST	443	49797	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.953341007 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.965754032 CEST	443	49797	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.986524105 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.986552000 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.986887932 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.988444090 CEST	49797	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.988452911 CEST	443	49797	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.988833904 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.988903999 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.988929033 CEST	443	49797	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.990380049 CEST	49797	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.990459919 CEST	443	49797	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:35.049258947 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:35.049258947 CEST	49797	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:48.261472940 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:48.261544943 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:48.261595964 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:48.275160074 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:48.275247097 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:48.275295019 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:48.987492085 CEST	49765	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:48.987492085 CEST	49766	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:48.987514019 CEST	443	49765	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:48.987523079 CEST	443	49766	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:49.033844948 CEST	49767	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:49.033859015 CEST	443	49767	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:49.865995884 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:49.866053104 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:49.866108894 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:49.873239994 CEST	443	49797	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:49.873294115 CEST	443	49797	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:49.873333931 CEST	49797	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:51.377196074 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:51.377233028 CEST	443	49773	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:51.377271891 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:51.377276897 CEST	443	49774	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:52.790340900 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:52.790385962 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:52.790461063 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:52.790796995 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:52.790810108 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.373285055 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.373370886 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.376663923 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.376672983 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.376902103 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.384505033 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.432499886 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.578708887 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.578730106 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.578762054 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.578896999 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.578896999 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.578911066 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.578958035 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.579359055 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.579395056 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.579416037 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.579421043 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.579442978 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.580017090 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.580061913 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.583597898 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.583610058 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:53.583620071 CEST	49801	443	192.168.2.4	20.12.23.50
Aug 30, 2024 08:35:53.583623886 CEST	443	49801	20.12.23.50	192.168.2.4
Aug 30, 2024 08:35:58.081248999 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.081279993 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.081362009 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.081434965 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.081459045 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.081515074 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.081577063 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.081589937 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.081681013 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.081695080 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.533766031 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.534003019 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.534020901 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.534307957 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.534562111 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.534617901 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.542439938 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.542604923 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.542618990 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.542913914 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.543179989 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.543243885 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.580015898 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.595659971 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.050518036 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.050542116 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.050551891 CEST	49753	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.050560951 CEST	443	49753	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.050568104 CEST	49759	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.050573111 CEST	443	49759	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.050685883 CEST	49760	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.050705910 CEST	443	49760	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.709583044 CEST	49805	443	192.168.2.4	23.219.161.132
Aug 30, 2024 08:36:00.709609985 CEST	443	49805	23.219.161.132	192.168.2.4
Aug 30, 2024 08:36:00.709690094 CEST	49805	443	192.168.2.4	23.219.161.132
Aug 30, 2024 08:36:00.709850073 CEST	49805	443	192.168.2.4	23.219.161.132
Aug 30, 2024 08:36:00.709862947 CEST	443	49805	23.219.161.132	192.168.2.4
Aug 30, 2024 08:36:01.186840057 CEST	443	49805	23.219.161.132	192.168.2.4
Aug 30, 2024 08:36:01.187299013 CEST	49805	443	192.168.2.4	23.219.161.132
Aug 30, 2024 08:36:01.187314987 CEST	443	49805	23.219.161.132	192.168.2.4
Aug 30, 2024 08:36:01.187630892 CEST	443	49805	23.219.161.132	192.168.2.4
Aug 30, 2024 08:36:01.187957048 CEST	49805	443	192.168.2.4	23.219.161.132
Aug 30, 2024 08:36:01.188019991 CEST	443	49805	23.219.161.132	192.168.2.4
Aug 30, 2024 08:36:01.188133001 CEST	49805	443	192.168.2.4	23.219.161.132
Aug 30, 2024 08:36:01.228508949 CEST	443	49805	23.219.161.132	192.168.2.4
Aug 30, 2024 08:36:01.340076923 CEST	443	49805	23.219.161.132	192.168.2.4
Aug 30, 2024 08:36:01.340127945 CEST	443	49805	23.219.161.132	192.168.2.4
Aug 30, 2024 08:36:01.340293884 CEST	49805	443	192.168.2.4	23.219.161.132
Aug 30, 2024 08:36:01.340498924 CEST	49805	443	192.168.2.4	23.219.161.132
Aug 30, 2024 08:36:01.340512037 CEST	443	49805	23.219.161.132	192.168.2.4
Aug 30, 2024 08:36:03.314384937 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:03.314408064 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:03.345643997 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:03.345670938 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:03.345683098 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:03.345686913 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:03.361258984 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:03.361263990 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:08.270011902 CEST	49723	80	192.168.2.4	93.184.221.240
Aug 30, 2024 08:36:08.270075083 CEST	49724	80	192.168.2.4	93.184.221.240
Aug 30, 2024 08:36:08.275101900 CEST	80	49723	93.184.221.240	192.168.2.4
Aug 30, 2024 08:36:08.275176048 CEST	49723	80	192.168.2.4	93.184.221.240
Aug 30, 2024 08:36:08.275558949 CEST	80	49724	93.184.221.240	192.168.2.4
Aug 30, 2024 08:36:08.275620937 CEST	49724	80	192.168.2.4	93.184.221.240
Aug 30, 2024 08:36:11.929173946 CEST	49798	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:11.929204941 CEST	443	49798	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:11.929403067 CEST	49797	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:11.929409027 CEST	443	49797	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:13.445554972 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:13.445606947 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:13.445663929 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:13.451735020 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:13.451809883 CEST	443	49802	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:13.451858044 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:33.268013954 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:33.268037081 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:33.283727884 CEST	49794	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:33.283746004 CEST	443	49794	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:34.002480030 CEST	49765	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:36:34.002501965 CEST	443	49765	142.251.40.227	192.168.2.4
Aug 30, 2024 08:36:34.002543926 CEST	49766	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:36:34.002551079 CEST	443	49766	142.251.40.227	192.168.2.4
Aug 30, 2024 08:36:34.049343109 CEST	49767	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:36:34.049360991 CEST	443	49767	142.251.40.227	192.168.2.4
Aug 30, 2024 08:36:36.377027988 CEST	49773	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:36:36.377027988 CEST	49774	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:36:36.377051115 CEST	443	49773	142.250.65.206	192.168.2.4
Aug 30, 2024 08:36:36.377062082 CEST	443	49774	142.250.65.206	192.168.2.4
Aug 30, 2024 08:36:48.324414015 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:48.324445009 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:48.347227097 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:48.347258091 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:48.347290993 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:48.347296953 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:48.363332033 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:48.363342047 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:58.455394983 CEST	49803	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:58.455414057 CEST	443	49803	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:58.456898928 CEST	49802	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:58.456928015 CEST	443	49802	162.159.61.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2024 08:34:58.590121984 CEST	53	57623	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:00.043124914 CEST	63454	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:00.043374062 CEST	57811	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.041582108 CEST	53	49663	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.054699898 CEST	53	59950	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.880923986 CEST	62995	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.881160975 CEST	61002	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.881721973 CEST	50166	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.881721973 CEST	61313	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.882091045 CEST	49468	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.882258892 CEST	61944	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.882648945 CEST	61009	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.882854939 CEST	51138	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.888010979 CEST	53	62995	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.888300896 CEST	53	61002	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.888358116 CEST	53	61313	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.888396978 CEST	53	50166	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.888617039 CEST	53	49468	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.889966011 CEST	53	51138	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.890028954 CEST	53	61944	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.890228033 CEST	53	61009	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.946202040 CEST	53105	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.946341991 CEST	62590	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:01.953278065 CEST	53	53105	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:01.953725100 CEST	53	62590	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:02.585519075 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.637391090 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.899517059 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:02.940303087 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.033607960 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.033652067 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.033757925 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.033792973 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.033834934 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.035882950 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.038062096 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.038208961 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.038921118 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.039037943 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.039145947 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.039407015 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.089909077 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.089930058 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.089958906 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.089972019 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.089996099 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.090673923 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.092607021 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.092818975 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.093417883 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.093533993 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.093646049 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.093764067 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.132571936 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.132586002 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.132601976 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.132622957 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.133017063 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.133094072 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.135261059 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.135921955 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.136534929 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.136665106 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.136931896 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.145744085 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.145924091 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.186064959 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.186137915 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.186156034 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.186172962 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.188543081 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.189486980 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.189580917 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.190476894 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.190532923 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.201736927 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.201901913 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.202270031 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.202426910 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.204751968 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.227247953 CEST	443	53140	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.255126953 CEST	53140	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.295449018 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:03.321991920 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:03.519699097 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.648835897 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.648893118 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.649369001 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.655093908 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.655124903 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.655190945 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.655528069 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.656919003 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.657661915 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.660680056 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.661361933 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.661370993 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.673590899 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.673619986 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.753753901 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.754024029 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.754355907 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.757488966 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.757781982 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.758505106 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.758625984 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.758646965 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.758879900 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.758995056 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.761197090 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.763983011 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.764152050 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.766938925 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.770740986 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.770772934 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.770893097 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.771573067 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.775250912 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.775420904 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.776757002 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.787668943 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.787864923 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.855206013 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.855268955 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.857243061 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.857546091 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.860516071 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.860603094 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.860819101 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.862389088 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.864893913 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.865087032 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.866090059 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.869745016 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.872370958 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.872519016 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.875298023 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.877202988 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.877619982 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.881314993 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.882812977 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.882838011 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.898639917 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.898653984 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.898711920 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.898739100 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.898876905 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.898936033 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.899040937 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.899728060 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.901231050 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.901611090 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.901750088 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.904256105 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.908418894 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.908591986 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.909693956 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.911547899 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.911689997 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.914627075 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.916649103 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.916862965 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.919631004 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.923157930 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.923813105 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.924618006 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.926800966 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.926958084 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.931155920 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.932163000 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.932311058 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.939810038 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.939888954 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.939912081 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.939997911 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.942418098 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.942562103 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.945154905 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.947691917 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.947851896 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.952033997 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.952966928 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.953175068 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.955806971 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.957979918 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.958131075 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.960093021 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.963288069 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.963443995 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.965260983 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.967567921 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.967740059 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.970803976 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.973391056 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.973539114 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.976165056 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.979012966 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.979168892 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.981012106 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.984241009 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.984400034 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.986248970 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.989043951 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.989188910 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.992075920 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.994277954 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.994430065 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:03.996282101 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.996362925 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:03.996633053 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.001272917 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.001619101 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.002230883 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.007343054 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.007498980 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.007707119 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.011336088 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.011801958 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.011975050 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.014534950 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.014676094 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.014959097 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.018084049 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.018516064 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.021259069 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.021420002 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.024574041 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.024672031 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.025000095 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.029259920 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.029630899 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.031300068 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.031446934 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.031761885 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.033593893 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.033778906 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.034063101 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.036631107 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.036722898 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.037122011 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.038954020 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.039252043 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.039410114 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.042973042 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.042984962 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.043371916 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.046127081 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.046741009 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.049560070 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.049860001 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.051733971 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.051755905 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.052936077 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.053312063 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.054503918 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.054649115 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.054851055 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.056632042 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.056765079 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.059020042 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.059031010 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.059050083 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.059063911 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.061363935 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.061374903 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.062669039 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.062716961 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.062846899 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.063927889 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.064007044 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.066103935 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.066180944 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.067485094 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.067646027 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.070077896 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.070722103 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.072669029 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.072772980 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.073050976 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.073781013 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.073853016 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.074645042 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.074656963 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.077378035 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.077424049 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.077435017 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.077454090 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.079873085 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.079972029 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.080327034 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.083687067 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.083698988 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.083717108 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.083728075 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.085890055 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.086014986 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.087759972 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.089677095 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.089750051 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.091799974 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.091967106 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.092125893 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.094341993 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.095669985 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.098563910 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.098766088 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.104353905 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.104892015 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.107939959 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.108258963 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.110513926 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.110757113 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.110920906 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.113136053 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.114386082 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.121157885 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.121172905 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.122947931 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.122960091 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.125991106 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.126576900 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.127348900 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.127504110 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.127518892 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.127974987 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.128145933 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.132781982 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.133049965 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.133970976 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.134413004 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.134860992 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.135008097 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.135581970 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.135742903 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.137144089 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.137284994 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.137295961 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.139403105 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.139642954 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.139655113 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.139672995 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.162606955 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.162781954 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.175115108 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.183347940 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.187453032 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.216274023 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.220506907 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.229414940 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.229477882 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.262590885 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.262624979 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.262689114 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.262700081 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.262711048 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.262840986 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.262851000 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.263052940 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.281073093 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.281547070 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.282444000 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.302544117 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.302973986 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.303704977 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.316620111 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.317161083 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.318715096 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.318866968 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.319771051 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.331955910 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.332443953 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.332623005 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.355247021 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:04.355444908 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:04.377441883 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.414972067 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.427910089 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.452279091 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:04.453244925 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:04.453757048 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:04.454022884 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:04.635694981 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:04.635819912 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:04.701468945 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.701545000 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.710510015 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.710556030 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.731954098 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:04.732144117 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:04.732153893 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:04.732441902 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:04.797396898 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.798024893 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.798336983 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.798784971 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.807320118 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.807893038 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.808073997 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.808299065 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.849600077 CEST	57422	443	192.168.2.4	142.251.40.227
Aug 30, 2024 08:35:04.903487921 CEST	443	57422	142.251.40.227	192.168.2.4
Aug 30, 2024 08:35:04.933228016 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:04.933459997 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:05.028161049 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:05.029155016 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:05.029273033 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:05.029664993 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:05.451445103 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.754024982 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.895879984 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.896033049 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.896431923 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.899235010 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.899286985 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.899296045 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.899326086 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.899535894 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.899931908 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.900799990 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.900926113 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.901273966 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.901457071 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.996423006 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.996463060 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:05.996872902 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:05.998348951 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.013230085 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.013569117 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.015036106 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.015045881 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.015228033 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:06.015270948 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.050451040 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:06.111553907 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:13.931464911 CEST	57480	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:13.931747913 CEST	63992	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:13.938308001 CEST	53	57480	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:13.939084053 CEST	53	63992	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:14.240700960 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:14.240780115 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:14.502485991 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:15.028234005 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:15.268316984 CEST	51540	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:15.374802113 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:15.376142979 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:15.377343893 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:15.408468008 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:15.410547972 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:15.410602093 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:15.410825968 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:15.439810038 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:15.506282091 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:15.580492020 CEST	51540	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:15.727546930 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:15.727572918 CEST	443	64461	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:15.731765985 CEST	443	51540	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:15.731806993 CEST	443	51540	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:15.738382101 CEST	64461	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:16.988982916 CEST	53	52197	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:17.437551022 CEST	63073	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:17.437817097 CEST	53698	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:17.438431978 CEST	63467	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:17.438649893 CEST	53271	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:17.444442987 CEST	53	53698	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:17.444569111 CEST	53	63073	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:17.445136070 CEST	53	63467	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:17.445184946 CEST	53	53271	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:17.492477894 CEST	59290	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:17.492666006 CEST	63535	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:35:17.499205112 CEST	53	59290	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:17.499418974 CEST	53	63535	1.1.1.1	192.168.2.4
Aug 30, 2024 08:35:20.213680029 CEST	138	138	192.168.2.4	192.168.2.255
Aug 30, 2024 08:35:23.114789963 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:23.114938021 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:23.213623047 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:23.214556932 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:23.214603901 CEST	443	59131	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:23.214826107 CEST	59131	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:23.216344118 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:23.216500044 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:23.690752983 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:23.690817118 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:23.690860987 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:23.690949917 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:23.690965891 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:23.691354036 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:23.691869020 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:23.692127943 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:23.797012091 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:23.797040939 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:23.797049999 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:23.797308922 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:23.829955101 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:23.842703104 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:23.843029976 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:23.843035936 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:23.876807928 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:23.981455088 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:32.895569086 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.205966949 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.342315912 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.342334986 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.342344046 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.342351913 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.342363119 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.370791912 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.371139050 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.376969099 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.382369041 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.382831097 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.385019064 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.385375977 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.475603104 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.475614071 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.475620985 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.475629091 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.475635052 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.476025105 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.476025105 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.478976011 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.481132984 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.501856089 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.503815889 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:33.572666883 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:33.611346006 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:34.500396013 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:34.501204967 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:34.502255917 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.593894005 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:34.594415903 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:34.594749928 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:34.595607042 CEST	443	55781	172.64.41.3	192.168.2.4
Aug 30, 2024 08:35:34.596949100 CEST	55781	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:35:34.774188995 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:34.774429083 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:34.811577082 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.949927092 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.949939966 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.949949026 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.950001001 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.950011969 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:34.953473091 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.953619957 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.986228943 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.987556934 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.987960100 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.989804029 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:34.990134954 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:35.086847067 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:35.086978912 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:35.086986065 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:35.086992979 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:35.087486029 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:35.087644100 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:35.089466095 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:35.090087891 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:35.090503931 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:35.090648890 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:35.186958075 CEST	443	59642	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:35.221210957 CEST	59642	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:35.223058939 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.223120928 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.223500967 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.223656893 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.223942995 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.223961115 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.224148035 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.224159956 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.240677118 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.317723989 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.317868948 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.318028927 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.318176985 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.318629980 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.334595919 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.334604979 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.334851027 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.334918022 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.410696983 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.410758972 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.562783003 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.653328896 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.670511007 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.670690060 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:35.670871019 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.705590963 CEST	56268	443	192.168.2.4	142.250.65.206
Aug 30, 2024 08:35:35.792289019 CEST	443	56268	142.250.65.206	192.168.2.4
Aug 30, 2024 08:35:36.691414118 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:36.821863890 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:36.861838102 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:36.893749952 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:36.893799067 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:36.894056082 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:36.894071102 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:36.894948959 CEST	56983	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:35:37.147530079 CEST	443	56983	142.251.111.84	192.168.2.4
Aug 30, 2024 08:35:58.080956936 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.392672062 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.527584076 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.527623892 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.528021097 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.528032064 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.528044939 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.528270960 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.530172110 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.530280113 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.530538082 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.530669928 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.627481937 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.627618074 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.627626896 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.627634048 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.627821922 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.627907038 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.628487110 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.629431009 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.629935980 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.630067110 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:35:58.724972010 CEST	443	56819	162.159.61.3	192.168.2.4
Aug 30, 2024 08:35:58.752516031 CEST	56819	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.051656961 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.051781893 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.051959991 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.052078962 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.423856020 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.497251034 CEST	443	59628	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.497900963 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.517807961 CEST	443	59628	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.517900944 CEST	443	59628	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.517910957 CEST	443	59628	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.517919064 CEST	443	59628	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.518153906 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.518153906 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.518229961 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.591528893 CEST	443	59628	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.611989975 CEST	443	59628	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.612474918 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:00.707535982 CEST	443	59628	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.708179951 CEST	443	59628	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.709126949 CEST	443	59628	162.159.61.3	192.168.2.4
Aug 30, 2024 08:36:00.709281921 CEST	59628	443	192.168.2.4	162.159.61.3
Aug 30, 2024 08:36:06.181396961 CEST	62346	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:36:06.181536913 CEST	50745	53	192.168.2.4	1.1.1.1
Aug 30, 2024 08:36:06.188080072 CEST	53	62346	1.1.1.1	192.168.2.4
Aug 30, 2024 08:36:06.188447952 CEST	53	50745	1.1.1.1	192.168.2.4
Aug 30, 2024 08:36:06.189281940 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.189414024 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.189599037 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.189712048 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.550360918 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.650474072 CEST	443	55893	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:06.650598049 CEST	443	55893	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:06.650608063 CEST	443	55893	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:06.650614977 CEST	443	55893	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:06.650623083 CEST	443	55893	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:06.651038885 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.651137114 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.651212931 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.651290894 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.746464968 CEST	443	55893	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:06.746746063 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.843796015 CEST	443	55893	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:06.844825029 CEST	443	55893	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:06.844868898 CEST	443	55893	172.64.41.3	192.168.2.4
Aug 30, 2024 08:36:06.845101118 CEST	55893	443	192.168.2.4	172.64.41.3
Aug 30, 2024 08:36:06.847058058 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:06.847179890 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.256062031 CEST	65218	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:36:07.256330013 CEST	65218	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:36:07.305092096 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.305109978 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.305576086 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.305650949 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.305918932 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.305944920 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.323714018 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.332273960 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.404700994 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.405742884 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.405750036 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.406048059 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.420237064 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.420814037 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.426327944 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.431834936 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.447228909 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.447237968 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.475785017 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.475805044 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.548541069 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.550692081 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.599808931 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.633790970 CEST	443	61952	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:07.634058952 CEST	61952	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:07.707762003 CEST	443	65218	142.251.111.84	192.168.2.4
Aug 30, 2024 08:36:07.707782984 CEST	443	65218	142.251.111.84	192.168.2.4
Aug 30, 2024 08:36:07.707791090 CEST	443	65218	142.251.111.84	192.168.2.4
Aug 30, 2024 08:36:07.708261967 CEST	65218	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:36:07.708334923 CEST	65218	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:36:07.708592892 CEST	65218	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:36:07.732134104 CEST	443	65218	142.251.111.84	192.168.2.4
Aug 30, 2024 08:36:07.806658983 CEST	443	65218	142.251.111.84	192.168.2.4
Aug 30, 2024 08:36:07.806945086 CEST	443	65218	142.251.111.84	192.168.2.4
Aug 30, 2024 08:36:07.807723045 CEST	65218	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:36:07.866326094 CEST	443	65218	142.251.111.84	192.168.2.4
Aug 30, 2024 08:36:07.866334915 CEST	443	65218	142.251.111.84	192.168.2.4
Aug 30, 2024 08:36:07.866533995 CEST	443	65218	142.251.111.84	192.168.2.4
Aug 30, 2024 08:36:07.866637945 CEST	65218	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:36:07.866707087 CEST	65218	443	192.168.2.4	142.251.111.84
Aug 30, 2024 08:36:07.990824938 CEST	443	65218	142.251.111.84	192.168.2.4
Aug 30, 2024 08:36:36.990042925 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:36.990216970 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:37.458638906 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:37.458655119 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:37.459328890 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:37.459438086 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:37.459757090 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:37.459769011 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:37.477819920 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:37.558043003 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:37.558465004 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:37.558473110 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:37.558672905 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:37.578557014 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:37.578567028 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:37.578964949 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:37.611794949 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:37.703500032 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:41.629697084 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:41.629749060 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:41.729381084 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:41.743549109 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:41.743819952 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:41.743839025 CEST	443	58443	142.250.80.110	192.168.2.4
Aug 30, 2024 08:36:41.784353018 CEST	58443	443	192.168.2.4	142.250.80.110
Aug 30, 2024 08:36:41.867590904 CEST	443	58443	142.250.80.110	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 30, 2024 08:35:00.043124914 CEST	192.168.2.4	1.1.1.1	0xf4e1	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:00.043374062 CEST	192.168.2.4	1.1.1.1	0x44fd	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 30, 2024 08:35:01.880923986 CEST	192.168.2.4	1.1.1.1	0x8e04	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.881160975 CEST	192.168.2.4	1.1.1.1	0x7ad5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 08:35:01.881721973 CEST	192.168.2.4	1.1.1.1	0x490f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.881721973 CEST	192.168.2.4	1.1.1.1	0x5f82	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 08:35:01.882091045 CEST	192.168.2.4	1.1.1.1	0x34dc	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.882258892 CEST	192.168.2.4	1.1.1.1	0x47be	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 08:35:01.882648945 CEST	192.168.2.4	1.1.1.1	0xfb99	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.882854939 CEST	192.168.2.4	1.1.1.1	0x8589	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 08:35:01.946202040 CEST	192.168.2.4	1.1.1.1	0x60a1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.946341991 CEST	192.168.2.4	1.1.1.1	0xd7fb	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 08:35:13.931464911 CEST	192.168.2.4	1.1.1.1	0x88f	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:13.931747913 CEST	192.168.2.4	1.1.1.1	0x8654	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Aug 30, 2024 08:35:17.437551022 CEST	192.168.2.4	1.1.1.1	0x23d9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:17.437817097 CEST	192.168.2.4	1.1.1.1	0xb0cf	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 08:35:17.438431978 CEST	192.168.2.4	1.1.1.1	0x626c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:17.438649893 CEST	192.168.2.4	1.1.1.1	0x74f5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 08:35:17.492477894 CEST	192.168.2.4	1.1.1.1	0x4206	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:17.492666006 CEST	192.168.2.4	1.1.1.1	0x5314	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 08:36:06.181396961 CEST	192.168.2.4	1.1.1.1	0xedcc	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:36:06.181536913 CEST	192.168.2.4	1.1.1.1	0xe78e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 30, 2024 08:35:00.053546906 CEST	1.1.1.1	192.168.2.4	0x44fd	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:00.054595947 CEST	1.1.1.1	192.168.2.4	0xf4e1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:01.888010979 CEST	1.1.1.1	192.168.2.4	0x8e04	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.888010979 CEST	1.1.1.1	192.168.2.4	0x8e04	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.888300896 CEST	1.1.1.1	192.168.2.4	0x7ad5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 08:35:01.888358116 CEST	1.1.1.1	192.168.2.4	0x5f82	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 08:35:01.888396978 CEST	1.1.1.1	192.168.2.4	0x490f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.888396978 CEST	1.1.1.1	192.168.2.4	0x490f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.888617039 CEST	1.1.1.1	192.168.2.4	0x34dc	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.888617039 CEST	1.1.1.1	192.168.2.4	0x34dc	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.889966011 CEST	1.1.1.1	192.168.2.4	0x8589	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 08:35:01.890028954 CEST	1.1.1.1	192.168.2.4	0x47be	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 08:35:01.890228033 CEST	1.1.1.1	192.168.2.4	0xfb99	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.890228033 CEST	1.1.1.1	192.168.2.4	0xfb99	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.953278065 CEST	1.1.1.1	192.168.2.4	0x60a1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.953278065 CEST	1.1.1.1	192.168.2.4	0x60a1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:01.953725100 CEST	1.1.1.1	192.168.2.4	0xd7fb	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 08:35:13.938308001 CEST	1.1.1.1	192.168.2.4	0x88f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:13.938308001 CEST	1.1.1.1	192.168.2.4	0x88f	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.161	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:13.939084053 CEST	1.1.1.1	192.168.2.4	0x8654	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:13.961734056 CEST	1.1.1.1	192.168.2.4	0xf37c	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	s-part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:13.961734056 CEST	1.1.1.1	192.168.2.4	0xf37c	No error (0)	s-part-0039.t-0009.t-msedge.net		13.107.246.67	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:15.844752073 CEST	1.1.1.1	192.168.2.4	0x7932	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:15.844752073 CEST	1.1.1.1	192.168.2.4	0x7932	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:15.844763994 CEST	1.1.1.1	192.168.2.4	0x9c11	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:16.870668888 CEST	1.1.1.1	192.168.2.4	0x8874	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:16.870668888 CEST	1.1.1.1	192.168.2.4	0x8874	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:16.870832920 CEST	1.1.1.1	192.168.2.4	0x5580	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:17.444442987 CEST	1.1.1.1	192.168.2.4	0xb0cf	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 08:35:17.444569111 CEST	1.1.1.1	192.168.2.4	0x23d9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:17.444569111 CEST	1.1.1.1	192.168.2.4	0x23d9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:17.445136070 CEST	1.1.1.1	192.168.2.4	0x626c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:17.445136070 CEST	1.1.1.1	192.168.2.4	0x626c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:17.445184946 CEST	1.1.1.1	192.168.2.4	0x74f5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 08:35:17.499205112 CEST	1.1.1.1	192.168.2.4	0x4206	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:17.499205112 CEST	1.1.1.1	192.168.2.4	0x4206	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:17.499418974 CEST	1.1.1.1	192.168.2.4	0x5314	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 08:35:18.904941082 CEST	1.1.1.1	192.168.2.4	0x6ce4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:18.904941082 CEST	1.1.1.1	192.168.2.4	0x6ce4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:20.048742056 CEST	1.1.1.1	192.168.2.4	0x6ce4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:20.048742056 CEST	1.1.1.1	192.168.2.4	0x6ce4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:21.057009935 CEST	1.1.1.1	192.168.2.4	0x6ce4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:21.057009935 CEST	1.1.1.1	192.168.2.4	0x6ce4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:23.057291985 CEST	1.1.1.1	192.168.2.4	0x6ce4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:23.057291985 CEST	1.1.1.1	192.168.2.4	0x6ce4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:35:27.064600945 CEST	1.1.1.1	192.168.2.4	0x6ce4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 08:35:27.064600945 CEST	1.1.1.1	192.168.2.4	0x6ce4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:36:06.188080072 CEST	1.1.1.1	192.168.2.4	0xedcc	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:36:06.188080072 CEST	1.1.1.1	192.168.2.4	0xedcc	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 08:36:06.188447952 CEST	1.1.1.1	192.168.2.4	0xe78e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

chrome.cloudflare-dns.com

arc.msn.com

edgeassetservice.azureedge.net

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	162.159.61.3	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 06:35:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 06:35:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 06:35:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb2c22c0b4f7283-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 06:35:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fb 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	162.159.61.3	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 06:35:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 06:35:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 06:35:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb2c22c2b678c45-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 06:35:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 aa 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49746	162.159.61.3	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 06:35:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 06:35:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 06:35:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb2c22c5f2c7d05-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 06:35:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49748	162.159.61.3	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 06:35:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 06:35:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 06:35:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb2c22c5f0c435e-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 06:35:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ad 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49752	172.64.41.3	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 06:35:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 06:35:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 06:35:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb2c22c7c131931-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 06:35:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c6 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49761	20.96.153.111	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:03 UTC	617	OUT	GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=-7651382275432408937&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1 Host: arc.msn.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 06:35:03 UTC	633	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400, private Content-Length: 2065 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"X-RADID":"P425775005-T700421790-C128000000003081769"},{"BATCH_REDIRECT_STORE":"B128000000003081769+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 30 Aug 2024 06:35:02 GMT Connection: close
2024-08-30 06:35:03 UTC	2065	IN	Data Raw: 7b 22 66 22 3a 22 72 61 66 22 2c 22 76 22 3a 22 31 2e 30 22 2c 22 72 64 72 22 3a 5b 7b 22 63 22 3a 22 41 6e 61 68 65 69 6d 20 50 61 73 73 77 6f 72 64 20 4d 6f 6e 69 74 6f 72 22 2c 22 75 22 3a 22 43 6f 6e 73 65 6e 74 20 53 61 76 65 20 50 61 73 73 77 6f 72 64 22 7d 5d 2c 22 61 64 22 3a 7b 22 54 49 54 4c 45 5f 53 41 56 45 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 55 50 44 41 54 45 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 53 41 56 45 44 5f 50 41 53 53 57 4f 52 44 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 4e 4f 5f 53 41 56 45 44 5f 50 41 53 53 57 4f 52 44 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 Data Ascii: {"f":"raf","v":"1.0","rdr":[{"c":"Anaheim Password Monitor","u":"Consent Save Password"}],"ad":{"TITLE_SAVE":"Save your password","TITLE_UPDATE":"Save your password","TITLE_SAVED_PASSWORD":"Save your password","TITLE_NO_SAVED_PASSWORD":"Save your password

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49763	13.107.246.40	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:03 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 06:35:03 UTC	559	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 06:35:03 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240830T063503Z-16579567576c4hpgz3uh2pbn5g0000000330000000000qwk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-30 06:35:03 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49762	13.107.246.40	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:03 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 06:35:03 UTC	583	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 06:35:03 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240830T063503Z-16579567576gnfmq2acf56mm7000000002sg00000000h4g2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-30 06:35:03 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-30 06:35:03 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-30 06:35:03 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-30 06:35:04 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-30 06:35:04 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49768	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:04 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-30 06:35:04 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=97309 Date: Fri, 30 Aug 2024 06:35:04 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49770	142.250.65.206	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:05 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-30 06:35:05 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 30 Aug 2024 06:35:05 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49769	142.250.65.206	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:05 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-30 06:35:05 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 30 Aug 2024 06:35:05 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49771	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:05 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-30 06:35:05 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=97261 Date: Fri, 30 Aug 2024 06:35:05 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-30 06:35:05 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49772	142.251.32.100	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:05 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-30 06:35:05 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 30 Aug 2024 06:11:03 GMT Expires: Sat, 07 Sep 2024 06:11:03 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 1442 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-30 06:35:05 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-30 06:35:05 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-30 06:35:05 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-30 06:35:05 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-30 06:35:05 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49781	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Knzu5llsVTOxzou&MD=cf25Gyt1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-30 06:35:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 92c1b0b8-b92d-4bd7-a808-67a1711fb212 MS-RequestId: 104b17b1-4e39-466a-bb44-4b78cd5c6b17 MS-CV: b5y2UnTCbEKn4BKE.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 30 Aug 2024 06:35:14 GMT Connection: close Content-Length: 24490
2024-08-30 06:35:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-30 06:35:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49783	142.250.185.161	443	9092	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:15 UTC	594	OUT	GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 06:35:15 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AHxI1nMwfvJ0smzaLBgesfx_UsIT_kx84xH1AyxbtDr9n9aCm0tnViwkefeoj26tHSQHDD7n4NI X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Thu, 29 Aug 2024 15:56:45 GMT Expires: Fri, 29 Aug 2025 15:56:45 GMT Cache-Control: public, max-age=31536000 Age: 52710 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-30 06:35:15 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-08-30 06:35:15 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-08-30 06:35:15 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-08-30 06:35:15 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-08-30 06:35:15 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-08-30 06:35:15 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-08-30 06:35:15 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-08-30 06:35:15 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-08-30 06:35:15 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-08-30 06:35:15 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49784	13.107.246.67	443	9092	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:15 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 06:35:15 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 06:35:15 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240830T063515Z-165795675767jvm9z21nmtw4wn00000002q000000000gg06 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-30 06:35:15 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49791	162.159.61.3	443	9092	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 06:35:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 06:35:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 06:35:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb2c28d8e1e7d11-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 06:35:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 05 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49792	172.64.41.3	443	9092	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 06:35:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 06:35:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 06:35:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb2c28d8e4d443e-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 06:35:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 dd 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49793	172.64.41.3	443	9092	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 06:35:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 06:35:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 06:35:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb2c28ddc327c7e-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 06:35:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 9d 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49796	152.195.19.97	443	9092	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:34 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725604516&P2=404&P3=2&P4=jbFRwzq7cEH98vOU3Gor4VB3laJFARUSUxarVuoPE0ux4jQrGLpL5WzZDu%2fIhmUG%2bBawl3Xkn7PbpumjDTY2LQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 9a7cw9emBvA17vBlU8Bzb9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 06:35:34 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4926265 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Fri, 30 Aug 2024 06:35:34 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-08-30 06:35:34 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49801	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:35:53 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Knzu5llsVTOxzou&MD=cf25Gyt1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-30 06:35:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 97df6087-29f0-472d-bada-8abc82d59aeb MS-RequestId: faa4b86f-6fa1-4225-9712-19ca9de2bd16 MS-CV: 64zAjvh78kCo5RLp.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 30 Aug 2024 06:35:52 GMT Connection: close Content-Length: 30005
2024-08-30 06:35:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-30 06:35:53 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49805	23.219.161.132	443	7260	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 06:36:01 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 06:36:01 UTC	331	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 Date: Fri, 30 Aug 2024 06:36:01 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.84112317.1724999761.d5d894f Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	02:34:54
Start date:	30/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x80000
File size:	917'504 bytes
MD5 hash:	F7D0BCF3675717C5157E215474EA4B5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	02:34:54
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:34:54
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2072,i,8180152950127741794,4817546992404905651,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:34:54
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:34:55
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2696 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:35:00
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:35:00
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6496 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:35:01
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7228 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7e5c60000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:35:02
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7228 --field-trial-handle=2456,i,6060751013287065761,2534262841454458591,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7e5c60000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:35:10
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	02:35:10
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2964 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:35:11
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4372 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:35:12
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6060 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8
Imagebase:	0x7ff7e5c60000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:35:12
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6060 --field-trial-handle=2032,i,12812671625741787738,15344975792162288261,262144 /prefetch:8
Imagebase:	0x7ff7e5c60000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:35:18
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:35:19
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1228 --field-trial-handle=2108,i,2381369830628417293,13375159391065227036,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:35:27
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:35:27
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2092,i,513492404789473333,1937958185482303577,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:35:40
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:35:41
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1996,i,13354447204659382061,17860069164876913799,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	1401
Total number of Limit Nodes:	39

Executed Functions

Function 000842DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0008430D

Part of subcall function 00086B57: _wcslen.LIBCMT ref: 00086B6A

GetCurrentProcess.KERNEL32(?,0011CB64,00000000,?,?), ref: 00084422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00084429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00084454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00084466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00084474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0008447B
GetSystemInfo.KERNEL32(?,?,?), ref: 000844A0

Strings

|O, xrefs: 000C36F8
GetNativeSystemInfo, xrefs: 00084460
kernel32.dll, xrefs: 0008444F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 80812ce0bd0395e419e754d300d3a9c8e1df127846ac703be5de3a03d15f5488
Instruction ID: 8e7c16ad6c7dcbf06363f81fcc28bc9c36d5c2c5b19d879bd30cb2500a2d7599
Opcode Fuzzy Hash: 80812ce0bd0395e419e754d300d3a9c8e1df127846ac703be5de3a03d15f5488
Instruction Fuzzy Hash: 86A1B6629193C0FFC7A3D769B8607D97FE47F36366B08989DD0819BE21D22045C8CB61

Function 000842A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,000850AA,?,?,00000000,00000000), ref: 000842B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,000850AA,?,?,00000000,00000000), ref: 000842C9
LoadResource.KERNEL32(?,00000000,?,?,000850AA,?,?,00000000,00000000,?,?,?,?,?,?,00084F20), ref: 000C35BE
SizeofResource.KERNEL32(?,00000000,?,?,000850AA,?,?,00000000,00000000,?,?,?,?,?,?,00084F20), ref: 000C35D3
LockResource.KERNEL32(000850AA,?,?,000850AA,?,?,00000000,00000000,?,?,?,?,?,?,00084F20,?), ref: 000C35E6

Strings

SCRIPT, xrefs: 000842BF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 973513523dd4dcc19bd96271dcf5962a98136da288b089ad434fd9c07b89a6ef
Instruction ID: b770b30e65938e38d5096edc604b1eba5c1944ed2741e9ec79955c202a3e68a3
Opcode Fuzzy Hash: 973513523dd4dcc19bd96271dcf5962a98136da288b089ad434fd9c07b89a6ef
Instruction Fuzzy Hash: 5A11EC30244705BFD7249B65DC48F677BB9FBC8B41F108168B402C6650CB71D8008660

Function 000C2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00082B6B

Part of subcall function 00083A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00151418,?,00082E7F,?,?,?,00000000), ref: 00083A78

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00142224), ref: 000C2C10
ShellExecuteW.SHELL32(00000000,?,?,00142224), ref: 000C2C17

Strings

runas, xrefs: 000C2C0B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: cafb6b5781d18ab0771e326b5465a6e03a93cd15b8c58fcf2075fcb6f98c518f
Instruction ID: 83ca868f7320d79966aea33fe9d949c88dadce816857ed5f1e5abe07622a78d2
Opcode Fuzzy Hash: cafb6b5781d18ab0771e326b5465a6e03a93cd15b8c58fcf2075fcb6f98c518f
Instruction Fuzzy Hash: DA11D331208301AAC715FF60D952EFEB7A4BBD1751F44142DF0C2260A3CF218A4A8752

Function 000EDBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,000C5222), ref: 000EDBCE
GetFileAttributesW.KERNELBASE(?), ref: 000EDBDD
FindFirstFileW.KERNEL32(?,?), ref: 000EDBEE
FindClose.KERNEL32(00000000), ref: 000EDBFA

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 9a5f4736b060c4a6385fa2cccc44570d9a21e3d11fb8162d53b86db077e68a3e
Instruction ID: 1caa63c959eeb62bb1951ea31b0d22f5b785a74c66302bdea7c27249d02c85e0
Opcode Fuzzy Hash: 9a5f4736b060c4a6385fa2cccc44570d9a21e3d11fb8162d53b86db077e68a3e
Instruction Fuzzy Hash: D2F0E530850911AB82246B7CEE0D8EA37ADDF01374B208703F836D24F0EBB05DA4C6D6

Function 0010AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0010B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0010B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0010B1D4
_wcslen.LIBCMT ref: 0010B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0010B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0010B236
_wcslen.LIBCMT ref: 0010B332

Part of subcall function 000F05A7: GetStdHandle.KERNEL32(000000F6), ref: 000F05C6

_wcslen.LIBCMT ref: 0010B34B
_wcslen.LIBCMT ref: 0010B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0010B3B6
GetLastError.KERNEL32(00000000), ref: 0010B407
CloseHandle.KERNEL32(?), ref: 0010B439
CloseHandle.KERNEL32(00000000), ref: 0010B44A
CloseHandle.KERNEL32(00000000), ref: 0010B45C
CloseHandle.KERNEL32(00000000), ref: 0010B46E
CloseHandle.KERNEL32(?), ref: 0010B4E3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: bdfe036238cd975771da479dfbeb1cf89f219a17ab6bc8a6e748e5532cd11258
Instruction ID: adf2ae23530ec056536e6976109c253b857abf61b1ac3480d818c781ad314737
Opcode Fuzzy Hash: bdfe036238cd975771da479dfbeb1cf89f219a17ab6bc8a6e748e5532cd11258
Instruction Fuzzy Hash: B8F17C316083409FCB14EF24C891BAEBBE5BF85714F14855DF8999B2A2DB71EC44CB92

Function 0008D730 Relevance: 21.6, APIs: 14, Instructions: 618windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0008D807
timeGetTime.WINMM ref: 0008DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0008DB28
TranslateMessage.USER32(?), ref: 0008DB7B
DispatchMessageW.USER32(?), ref: 0008DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0008DB9F
Sleep.KERNELBASE(0000000A), ref: 0008DBB1

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: f5a491d248d77e317b645f1685794aad9153b8f608b052cbd0fce1d1db148eaf
Instruction ID: fdd4b90fa88228cf4378e008dbadbf6dc3b4b73df26c2d398e86e9a7e1158fee
Opcode Fuzzy Hash: f5a491d248d77e317b645f1685794aad9153b8f608b052cbd0fce1d1db148eaf
Instruction Fuzzy Hash: 0642BE70608342EFD769EB24C844BAAB7E1BF95314F15861BE495873D2DB70E884CB92

Function 00082CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00082D07
RegisterClassExW.USER32(00000030), ref: 00082D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00082D42
InitCommonControlsEx.COMCTL32(?), ref: 00082D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00082D6F
LoadIconW.USER32(000000A9), ref: 00082D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00082D94

Strings

AutoIt v3 GUI, xrefs: 00082D23
TaskbarCreated, xrefs: 00082D37
+, xrefs: 00082CF0
0, xrefs: 00082CE9

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a2caf3a27bc0ec0dd2c5a0c233162860e1b7d60925e0aac788604b26fab1fdce
Instruction ID: 4532ca6a2068463770d5cd3a02d360ea1ee5c4b0181486b4ccc286f1fce5e33e
Opcode Fuzzy Hash: a2caf3a27bc0ec0dd2c5a0c233162860e1b7d60925e0aac788604b26fab1fdce
Instruction Fuzzy Hash: 2D21E0B5941308EFDB01DFA8E989BDDBBB4FB08705F00811AF511AA6A0D7B14580CF90

Function 000C065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C039A: CreateFileW.KERNELBASE(00000000,00000000,?,000C0704,?,?,00000000,?,000C0704,00000000,0000000C), ref: 000C03B7

GetLastError.KERNEL32 ref: 000C076F
__dosmaperr.LIBCMT ref: 000C0776
GetFileType.KERNELBASE(00000000), ref: 000C0782
GetLastError.KERNEL32 ref: 000C078C
__dosmaperr.LIBCMT ref: 000C0795
CloseHandle.KERNEL32(00000000), ref: 000C07B5
CloseHandle.KERNEL32(?), ref: 000C08FF
GetLastError.KERNEL32 ref: 000C0931
__dosmaperr.LIBCMT ref: 000C0938

Strings

H, xrefs: 000C08BD

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: e6d62dc09006d0df91e1da505daa94b4d6de19e84fe65beff7b32a13093f7d6a
Instruction ID: 4be28a448db39739b9589e8aa2083a585acffb0bdf10e963e5d09ca177a55dca
Opcode Fuzzy Hash: e6d62dc09006d0df91e1da505daa94b4d6de19e84fe65beff7b32a13093f7d6a
Instruction Fuzzy Hash: 25A1F532A14115CFDF29AFA8D851BEE7BE0AB06320F14415DF8159F292DB319D52CB91

Function 0008344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00083A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00151418,?,00082E7F,?,?,?,00000000), ref: 00083A78

Part of subcall function 00083357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00083379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0008356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 000C318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 000C31CE
RegCloseKey.ADVAPI32(?), ref: 000C3210
_wcslen.LIBCMT ref: 000C3277
_wcslen.LIBCMT ref: 000C3286

Strings

\, xrefs: 000C328C
Include, xrefs: 000C3184, 000C31C5
Software\AutoIt v3\AutoIt, xrefs: 00083560
\Include\, xrefs: 00083527

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 615d96b00860d1a615690c22854d1ff77f8330f5254b281fb1cab31984bec284
Instruction ID: 57fe0af4fb0b8f3e96053f40db74b40a98b34d25984d331e34da37ece390f40f
Opcode Fuzzy Hash: 615d96b00860d1a615690c22854d1ff77f8330f5254b281fb1cab31984bec284
Instruction Fuzzy Hash: C2719F72508301DEC754EF65EC81DABBBE8FF9A740F40442EF4859B161EB709A88CB52

Function 00082B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00082B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00082B9D
LoadIconW.USER32(00000063), ref: 00082BB3
LoadIconW.USER32(000000A4), ref: 00082BC5
LoadIconW.USER32(000000A2), ref: 00082BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00082BEF
RegisterClassExW.USER32(?), ref: 00082C40

Part of subcall function 00082CD4: GetSysColorBrush.USER32(0000000F), ref: 00082D07
Part of subcall function 00082CD4: RegisterClassExW.USER32(00000030), ref: 00082D31
Part of subcall function 00082CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00082D42
Part of subcall function 00082CD4: InitCommonControlsEx.COMCTL32(?), ref: 00082D5F
Part of subcall function 00082CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00082D6F
Part of subcall function 00082CD4: LoadIconW.USER32(000000A9), ref: 00082D85
Part of subcall function 00082CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00082D94

Strings

0, xrefs: 00082C0F
#, xrefs: 00082C16
AutoIt v3, xrefs: 00082C2F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: e188698b4475fa97f4df0f409a2ecf56c3743cecde0dc1171bd443eb26dd6357
Instruction ID: b3b16f065af05b31748370f01a55d3510d39d9bb37c7d6c5289d875116e7cfc2
Opcode Fuzzy Hash: e188698b4475fa97f4df0f409a2ecf56c3743cecde0dc1171bd443eb26dd6357
Instruction Fuzzy Hash: 1B214F70E40314FFDB519F95ED65B997FB4FB48B61F00415AE500AAAA0D3B10580CF90

Function 00083170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0008316A,?,?), ref: 000831D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0008316A,?,?), ref: 00083204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00083227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0008316A,?,?), ref: 00083232
CreatePopupMenu.USER32 ref: 00083246
PostQuitMessage.USER32(00000000), ref: 00083267

Strings

TaskbarCreated, xrefs: 0008322D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: cada60b533129876337fdb2ef94a131a47c2342e60de9fd9deaa8187aae52d8a
Instruction ID: 0717ef107896349e155d64c31a8b73b53cd77ae70a23a5d6738fe5a2d11892fa
Opcode Fuzzy Hash: cada60b533129876337fdb2ef94a131a47c2342e60de9fd9deaa8187aae52d8a
Instruction Fuzzy Hash: BD416B31240300FBDF663B789D1DBFD369AF785F05F040125F9929A9E2CBB09A8087A1

Function 00082C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00082C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00082CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00081CAD,?), ref: 00082CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00081CAD,?), ref: 00082CCF

Strings

AutoIt v3, xrefs: 00082C89, 00082C8E, 00082C8F
edit, xrefs: 00082CAC

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 46c74fe52b4a80bcf77521022fdbd97a7a1dd450f36a53dba9c70bf40ef409d0
Instruction ID: ff1aea3d8056ccb0ccad3980bc098278fbc749c9fc86483fae5889d4c8f89442
Opcode Fuzzy Hash: 46c74fe52b4a80bcf77521022fdbd97a7a1dd450f36a53dba9c70bf40ef409d0
Instruction Fuzzy Hash: 38F0DA75581394BAEB721717AC18FB73EBDE7C6F61F01406AF900AA9B0C6611890DAB4

Function 000EE97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 000EE997
QueryPerformanceFrequency.KERNEL32(?), ref: 000EE9A5
Sleep.KERNEL32(00000000), ref: 000EE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 000EE9B7
Sleep.KERNELBASE ref: 000EE9F3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 2f1b09e1ef4718b2aba7e4321665aff8c62d702dbfe7360bd273ef6ef0bf2939
Instruction ID: 4d037779b66b1a6dfa2e5ce3b472e9ffb945663a76a07eb61b894cb39555079e
Opcode Fuzzy Hash: 2f1b09e1ef4718b2aba7e4321665aff8c62d702dbfe7360bd273ef6ef0bf2939
Instruction Fuzzy Hash: F2016931D416ADEBCF44AFE6DD49AEDBBB8FF09300F004556E502B2242CB309590CBA1

Function 00083B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00083B0F,SwapMouseButtons,00000004,?), ref: 00083B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00083B0F,SwapMouseButtons,00000004,?), ref: 00083B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00083B0F,SwapMouseButtons,00000004,?), ref: 00083B83

Strings

Control Panel\Mouse, xrefs: 00083B3E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: a0a6ea41b5dd8590d95a0d01d473dec38a9b5afc89bf2768fb87bbdb59fb8ead
Instruction ID: 948b861cf8bf2ea3e94c6280740f3e99f50361f218e7d26d706d1d890d441b23
Opcode Fuzzy Hash: a0a6ea41b5dd8590d95a0d01d473dec38a9b5afc89bf2768fb87bbdb59fb8ead
Instruction Fuzzy Hash: 5B1118B5510208FFDB609FA5DC44AEEBBA8EF84B84B108469BA45D7110E3319E4097A0

Function 00083923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 000C33A2

Part of subcall function 00086B57: _wcslen.LIBCMT ref: 00086B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00083A04

Strings

Line: , xrefs: 000C33EB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 99447cddc72e9971adf23ecfe65321a89d8203bf34b7fead63dcb198b95cda56
Instruction ID: 12164dae22ecc30c3d159894b279bde660c0c2ca5483784429b6b070a078336f
Opcode Fuzzy Hash: 99447cddc72e9971adf23ecfe65321a89d8203bf34b7fead63dcb198b95cda56
Instruction Fuzzy Hash: AB31C371408304AAC765FB20DC45BEFB7D8BB81B20F00492EF5D996492EB709789C7C2

Function 0009FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000A0668

Part of subcall function 000A32A4: RaiseException.KERNEL32(?,?,?,000A068A,?,00151444,?,?,?,?,?,?,000A068A,00081129,00148738,00081129), ref: 000A3304

__CxxThrowException@8.LIBVCRUNTIME ref: 000A0685

Strings

Unknown exception, xrefs: 000A0692

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: d84bc126c42eb4e645c01433ac08527313ea4ebdccf41bf1d597a5cd5f3b4b69
Instruction ID: a302fdd8dc97a845e1e41cda941da1be821c726d1bc2483a9dc7575e1bd3c0a0
Opcode Fuzzy Hash: d84bc126c42eb4e645c01433ac08527313ea4ebdccf41bf1d597a5cd5f3b4b69
Instruction Fuzzy Hash: A6F0C23490020DB7CF04B6F4D846DEE77AD5F42394B604131B814D65E2EF71EA65C6C0

Function 000810F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00081BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00081BF4
Part of subcall function 00081BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00081BFC
Part of subcall function 00081BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00081C07
Part of subcall function 00081BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00081C12
Part of subcall function 00081BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00081C1A
Part of subcall function 00081BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00081C22

Part of subcall function 00081B4A: RegisterWindowMessageW.USER32(00000004,?,000812C4), ref: 00081BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0008136A
OleInitialize.OLE32 ref: 00081388
CloseHandle.KERNEL32(00000000,00000000), ref: 000C24AB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 9ee37aa0d46a94b954f6a6f4609b0afa0e46ca70ebdb4f52d094ee4951b9f359
Instruction ID: ef40c766f90f08e93508944cdb114412426f214b9d809b906c5e8d6de083237e
Opcode Fuzzy Hash: 9ee37aa0d46a94b954f6a6f4609b0afa0e46ca70ebdb4f52d094ee4951b9f359
Instruction Fuzzy Hash: 5471EEB4921300EFC786EF79AA457943BE4BB8A346354862AD45ADFB62F77048C5CF40

Function 000EC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00083923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00083A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000EC259
KillTimer.USER32(?,00000001,?,?), ref: 000EC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 000EC270

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 0e55347d8c4aaf6bd1309ee04952491e9ffff6aa238348349693df78ae677a9d
Instruction ID: a0d73a907377d7e2bd5c842550c16af1bfe867d72c082801eb44e5e15e62b386
Opcode Fuzzy Hash: 0e55347d8c4aaf6bd1309ee04952491e9ffff6aa238348349693df78ae677a9d
Instruction Fuzzy Hash: ED31C370904384AFFB729F658855BEBBBECAF07304F00449EE6DAA7241C3755A85CB51

Function 000B86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,000B85CC,?,00148CC8,0000000C), ref: 000B8704
GetLastError.KERNEL32(?,000B85CC,?,00148CC8,0000000C), ref: 000B870E
__dosmaperr.LIBCMT ref: 000B8739

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 9428a9ce922a2af94a5329c539e25a4398c7f63e6b92547045706608297ee81c
Instruction ID: dab88de9841e92101e9416c9286bffa4d6806438d8362d5a9641c8396a942f3e
Opcode Fuzzy Hash: 9428a9ce922a2af94a5329c539e25a4398c7f63e6b92547045706608297ee81c
Instruction Fuzzy Hash: 8A0108326056202AD6E57274AC457FE67CD8B82B79F398159E8149B2E3DEA0CD81C390

Function 0008DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0008DB7B
DispatchMessageW.USER32(?), ref: 0008DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0008DB9F
Sleep.KERNELBASE(0000000A), ref: 0008DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 000D1CC9

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 6249979240e489bd3699e8443eea3e90b75413b3c0ecc430fe7951751d6d94b7
Instruction ID: 29be7fb8912187f3ba866aa2cfe96017683be30fd076958b68a6a721c99c7b6f
Opcode Fuzzy Hash: 6249979240e489bd3699e8443eea3e90b75413b3c0ecc430fe7951751d6d94b7
Instruction Fuzzy Hash: E7F05E30644380EBEB74DB60CD49FEA73EDFB44311F104A1AE65A874C0DB7094889B65

Function 00091310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 000917F6

Strings

CALL, xrefs: 000917C6

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 4e9b999ad91f4086d49088fb7efd433d20ae7df30973bbfd23f690def0e87ade
Instruction ID: bab83e38834e9506c848f746dd80b8d1c1bbe69d8e0272dfcd6b9b1f0cb40eee
Opcode Fuzzy Hash: 4e9b999ad91f4086d49088fb7efd433d20ae7df30973bbfd23f690def0e87ade
Instruction Fuzzy Hash: 71226B70608302DFCB24DF14C484AAABBF1BF89314F15895DF4968B3A2D772E945DB92

Function 00082DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 000C2C8C

Part of subcall function 00083AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00083A97,?,?,00082E7F,?,?,?,00000000), ref: 00083AC2

Part of subcall function 00082DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00082DC4

Strings

X, xrefs: 000C2C5A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 36ff69d725a560245ec7ceca50f9afdb77ae28d73582d18341dd70dac5af4b78
Instruction ID: c8c05920f649c516aa7448d7e013d8a5d55ad71bdd17adfc9768a13fc28c0014
Opcode Fuzzy Hash: 36ff69d725a560245ec7ceca50f9afdb77ae28d73582d18341dd70dac5af4b78
Instruction Fuzzy Hash: 1A21A271A002589FCF41EF94D849BEE7BF8AF49715F008059E445BB242DBB49A898FA1

Function 00083837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00083908

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: b8c469c61c767815e6dbc9a96dd15722be12369665440fef9f185e02e7507d0e
Instruction ID: bdaf4f72bb5485a247024294e7c7a8bc3deaaeb04ee0d19cffd8597c226f62a3
Opcode Fuzzy Hash: b8c469c61c767815e6dbc9a96dd15722be12369665440fef9f185e02e7507d0e
Instruction Fuzzy Hash: 2031BF70604301DFD761EF24D894B9BBBE8FB89719F00092EF9D987650EB71AA44CB52

Function 0009F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0009F661

Part of subcall function 0008D730: GetInputState.USER32 ref: 0008D807

Sleep.KERNEL32(00000000), ref: 000DF2DE

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 7617e08d072c094858a0c1ba7635c3f157d908ce1b40b9870ba0262d1465e5cb
Instruction ID: c5c583682ee0443891dfe8acd5c4bdd783524469c769214db78e744b34d5e252
Opcode Fuzzy Hash: 7617e08d072c094858a0c1ba7635c3f157d908ce1b40b9870ba0262d1465e5cb
Instruction Fuzzy Hash: 80F082712807059FD314FF65D545BAABBE4FF55760F00402AE859C73A1DB70A840CB90

Function 0008B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0008BB4E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 77a6c92423363d7add5425b813a9654eacd75eac6760d51d8aaa8d33ba786d83
Instruction ID: 96b3e865dcc321d28b1f24d7b4984ed7cdd2952d6a1f493149c05e73734e2e35
Opcode Fuzzy Hash: 77a6c92423363d7add5425b813a9654eacd75eac6760d51d8aaa8d33ba786d83
Instruction Fuzzy Hash: 71328B35A00209DFDB24EF54C894BBEB7F9FB45300F14805AE999AB361D774AE81CB61

Function 00112598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00112649

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: cd8bbfc9ceebcdc3833ad9dce76facce012f34945c2b55e0dd3fa0996a5f3875
Instruction ID: 82a61cba6a5f3fe2c6930dbdcd34c3a8f2fd8d87979c94c476bf05f7f1de3c21
Opcode Fuzzy Hash: cd8bbfc9ceebcdc3833ad9dce76facce012f34945c2b55e0dd3fa0996a5f3875
Instruction Fuzzy Hash: D121D074200259AFE758DF14D8D0DB6B7AAEF44368B20807CE8968B392C771ED91CB90

Function 001113B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00111420

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 1ae428a9ed4a632b3ef86b25fa11c796fb18c38b86e453f42c68fdc700b70eb6
Instruction ID: a92adc90b2430f90f23ff883d666681d451dfbb92d5dcee3e0f7c8ef04885a76
Opcode Fuzzy Hash: 1ae428a9ed4a632b3ef86b25fa11c796fb18c38b86e453f42c68fdc700b70eb6
Instruction Fuzzy Hash: 0C31A030204252AFD718EF25C491BA9F7A2FF45328F048178E8594B693DB71EC81CBD0

Function 00084ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00084E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00084EDD,?,00151418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00084E9C
Part of subcall function 00084E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00084EAE
Part of subcall function 00084E90: FreeLibrary.KERNEL32(00000000,?,?,00084EDD,?,00151418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00084EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00151418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00084EFD

Part of subcall function 00084E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,000C3CDE,?,00151418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00084E62
Part of subcall function 00084E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00084E74
Part of subcall function 00084E59: FreeLibrary.KERNEL32(00000000,?,?,000C3CDE,?,00151418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00084E87

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: c0af0440e4b8c74239adf0e7140e7de0172f5769c012fd36812683cfc09d1b98
Instruction ID: d7fb8b362e3105011e2a46bed55290fe188d3c0acd905a383566a422fa093b91
Opcode Fuzzy Hash: c0af0440e4b8c74239adf0e7140e7de0172f5769c012fd36812683cfc09d1b98
Instruction Fuzzy Hash: 6D11E332610206AACF24BF60DC02FED77A5BF40715F10842EF682A62C3EE709A459B90

Function 000B8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 000B8440

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2e90188a0e3968de7c8fc74c6890dbe634fd32f0c3f3f94d23209a75c7e67826
Instruction ID: cd2773d2904ebeec9cf4cb1023cc199d2c7c7a0335dbd8432a0c7b06290cb63b
Opcode Fuzzy Hash: 2e90188a0e3968de7c8fc74c6890dbe634fd32f0c3f3f94d23209a75c7e67826
Instruction Fuzzy Hash: 1611067590420AAFCB15DF58E941ADE7BF9EF48314F148059F808AB312DB31DA11CBA5

Function 000B5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000B4C7D: RtlAllocateHeap.NTDLL(00000008,00081129,00000000,?,000B2E29,00000001,00000364,?,?,?,000AF2DE,000B3863,00151444,?,0009FDF5,?), ref: 000B4CBE

_free.LIBCMT ref: 000B506C

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 95595639be151216339f3dbf7a83b38abc2b6606002401ac53fef83d8ff2a798
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: BD0126722047056BE3319E659C85ADAFBE8FB89370F25055DE18483281EA30A905C6B4

Function 001129BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,001114B5,?), ref: 00112A01

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 2095ec4572b4be2e0d46e7ff7e9a8549b9920624208df2104a9645d13a2ecd9e
Instruction ID: cab24ad3f9f8311a163a26d4e35cf7acb035face4428bd4fea46159287856c06
Opcode Fuzzy Hash: 2095ec4572b4be2e0d46e7ff7e9a8549b9920624208df2104a9645d13a2ecd9e
Instruction Fuzzy Hash: D2019E36340A519FD32D8A2CE454BA27792EF85318F298478C0478B651DB32EC92C7A0

Function 000AE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: c76ab91998ef5f3295c3f7e5fc21680ecdfe1e7803175f74d4e06e94e0351f22
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: EBF0F432510A10A6D6313AE9DC05BDA339C9F533B4F100B15F425921D3DB70D80186A5

Function 0011149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 001114EB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 0770a194cbca4e74e287423aded723b6dcb037e6433c93c84a57807622f0e02d
Instruction ID: a8d881612f604a592d0320cecf81f67114a2f6a576f03019ed061682e83a5c42
Opcode Fuzzy Hash: 0770a194cbca4e74e287423aded723b6dcb037e6433c93c84a57807622f0e02d
Instruction Fuzzy Hash: D1012431309211AF9328CF69D44086AFB94FF907283548079E94A8BB02D732DCC2C7C0

Function 000B4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00081129,00000000,?,000B2E29,00000001,00000364,?,?,?,000AF2DE,000B3863,00151444,?,0009FDF5,?), ref: 000B4CBE

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 41c6442f8240af71c69e46580904fcbc28508df0d61a363061ca6b3adecd0ed9
Instruction ID: fbdbd506fbdc53cc29816af35d439baf28984f80f2d5162e0ec4370a19eb2500
Opcode Fuzzy Hash: 41c6442f8240af71c69e46580904fcbc28508df0d61a363061ca6b3adecd0ed9
Instruction Fuzzy Hash: A9F0B431642228A6DBE15FA29C09BDA3FC8FF81BA1B144121F81DAA183CA70DE0046E0

Function 000B3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00151444,?,0009FDF5,?,?,0008A976,00000010,00151440,000813FC,?,000813C6,?,00081129), ref: 000B3852

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1796a39d9533c9c18b31be05cb9dfb23bb4923a22c8c5a56c6e51e846ae5cef1
Instruction ID: 24a3dd82e5e4c8b0f783f39bcf528ec2eee34d280d0d082b52d42464b95b778e
Opcode Fuzzy Hash: 1796a39d9533c9c18b31be05cb9dfb23bb4923a22c8c5a56c6e51e846ae5cef1
Instruction Fuzzy Hash: 5CE0ED35140325AAE7712AAA9C01BDA3688BB82BF0F260030BC0496992DF60DE0182E2

Function 00084F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00151418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00084F6D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 8433008d18488d0e27192c495c7c53f97947b13bfad63c7a211e913ae3582df8
Instruction ID: b24544c528f300b9812f8a72d3f070602c0a1a841beed42f21c44b2a31c12bae
Opcode Fuzzy Hash: 8433008d18488d0e27192c495c7c53f97947b13bfad63c7a211e913ae3582df8
Instruction Fuzzy Hash: D1F03971105752CFDB38AF64D490866BBE4BF143293258A7EE2EA82622C7319884DF50

Function 00112A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00112A66

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: bb15d2014251b3216b94a32ee43efb172b232ce8bf68cefa8d42b208e92a8b82
Instruction ID: 27ddad90e8e18fbc0cd1081b6cd4e334d7c0fa604d035589de46cba2a9391ea3
Opcode Fuzzy Hash: bb15d2014251b3216b94a32ee43efb172b232ce8bf68cefa8d42b208e92a8b82
Instruction Fuzzy Hash: 89E04F3639411AAECB18EA31EC848FEB75CEF50395710453AEC16D3501EB30A9E596E0

Function 00082DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00082DC4

Part of subcall function 00086B57: _wcslen.LIBCMT ref: 00086B6A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 6103ea40af003a452e7ece43b6f1a42baa717604b133173f7e5533257d3825ec
Instruction ID: a5d19fbd7de6078f01cc5a355a3a28c858da65c101667fbd9881f9d964a81ecb
Opcode Fuzzy Hash: 6103ea40af003a452e7ece43b6f1a42baa717604b133173f7e5533257d3825ec
Instruction Fuzzy Hash: C5E0CD726002245BC710A3589C05FDA77DDDFC8790F054075FD09D7249DA70EDC08690

Function 00082B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00083837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00083908

Part of subcall function 0008D730: GetInputState.USER32 ref: 0008D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00082B6B

Part of subcall function 000830F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0008314E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: bc707e262d7b9c640c4e9aad91bf0c90dc0a6bdbd3b10953d018f58f381833eb
Instruction ID: ecc060f86283c3dc50cdc4a8e7eb6da9b24b18d43da8e5f46dbd09a4aef02602
Opcode Fuzzy Hash: bc707e262d7b9c640c4e9aad91bf0c90dc0a6bdbd3b10953d018f58f381833eb
Instruction Fuzzy Hash: 0DE0262130430452CA08BB30A8125FDB349BBD1712F40153EF0C2471A3CF2089894352

Function 000E3D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 000E3D18

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: ae4909a4cf8120e43118e56f9032505c47dfc0e84f487bc69c3aee16105adce3
Instruction ID: ab0391a922c5af53c4c91007c59fc6396a98a8796323d192820e0fb40238aac8
Opcode Fuzzy Hash: ae4909a4cf8120e43118e56f9032505c47dfc0e84f487bc69c3aee16105adce3
Instruction Fuzzy Hash: 30D012E06A03087EFB0483718D0BEBB329CC316A81F008BA47A02D69C1E9A0DE084170

Function 000C039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,000C0704,?,?,00000000,?,000C0704,00000000,0000000C), ref: 000C03B7

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5f48e4fd4080b37f5878791928a6febded55e4ed6d6b692e44bb8c761c448c50
Instruction ID: 1df064ff4a0b5895cd09748179484ec0b7da2502b5cb4f013a95ea608a1d4e54
Opcode Fuzzy Hash: 5f48e4fd4080b37f5878791928a6febded55e4ed6d6b692e44bb8c761c448c50
Instruction Fuzzy Hash: 33D06C3208010DFBDF029F84DD06EDA3BAAFB48714F018000BE1856020C732E861AB90

Function 00081CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00081CBC

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: df55ec14941adcacd5a3001a0bc3cd91f0051c8759cb59e5ef47e46b8dc8f932
Instruction ID: 462480e46fe3ee48928e94add62487a99e62bebf7f8a8928f2458abd13cf2e47
Opcode Fuzzy Hash: df55ec14941adcacd5a3001a0bc3cd91f0051c8759cb59e5ef47e46b8dc8f932
Instruction Fuzzy Hash: 93C092363C0305EFF25A8B80BD5AF907765B349B12F048401F609ADDF3D3B228A0EA91

Non-executed Functions

Function 00119576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00099BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00099BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0011961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0011965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0011969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001196C9
SendMessageW.USER32 ref: 001196F2
GetKeyState.USER32(00000011), ref: 0011978B
GetKeyState.USER32(00000009), ref: 00119798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 001197AE
GetKeyState.USER32(00000010), ref: 001197B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001197E9
SendMessageW.USER32 ref: 00119810
SendMessageW.USER32(?,00001030,?,00117E95), ref: 00119918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0011992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00119941
SetCapture.USER32(?), ref: 0011994A
ClientToScreen.USER32(?,?), ref: 001199AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 001199BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001199D6
ReleaseCapture.USER32 ref: 001199E1
GetCursorPos.USER32(?), ref: 00119A19
ScreenToClient.USER32(?,?), ref: 00119A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00119A80
SendMessageW.USER32 ref: 00119AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00119AEB
SendMessageW.USER32 ref: 00119B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00119B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00119B4A
GetCursorPos.USER32(?), ref: 00119B68
ScreenToClient.USER32(?,?), ref: 00119B75
GetParent.USER32(?), ref: 00119B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00119BFA
SendMessageW.USER32 ref: 00119C2B
ClientToScreen.USER32(?,?), ref: 00119C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00119CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00119CDE
SendMessageW.USER32 ref: 00119D01
ClientToScreen.USER32(?,?), ref: 00119D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00119D82

Part of subcall function 00099944: GetWindowLongW.USER32(?,000000EB), ref: 00099952

GetWindowLongW.USER32(?,000000F0), ref: 00119E05

Strings

@GUI_DRAGID, xrefs: 0011997D
F, xrefs: 00119D07

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 05ec46dc662e90f7a3a137c206336c4bb93302ec35e33eb2d84df6a8c7cbe3d2
Instruction ID: 4b14c7b6aec70d7fb807b4ee7f563569111ea652b08767973c952fc08e095062
Opcode Fuzzy Hash: 05ec46dc662e90f7a3a137c206336c4bb93302ec35e33eb2d84df6a8c7cbe3d2
Instruction Fuzzy Hash: 0B428D74204201EFDB29CF24CD54BEABBE5FF89314F144629F6A9876A1D731A890CF91

Function 00114873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 001148F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00114908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00114927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0011494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0011495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0011497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 001149AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 001149D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00114A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00114A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00114A7E
IsMenu.USER32(?), ref: 00114A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00114AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00114B20
GetWindowLongW.USER32(?,000000F0), ref: 00114B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00114BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00114C82
wsprintfW.USER32 ref: 00114CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00114CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00114CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00114D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00114D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00114D5A

Strings

%d/%02d/%02d, xrefs: 00114CA8

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: b0339c2a41342be96e7d0daa3db23160d6caad386300062a035e9683d57c5d82
Instruction ID: 667cb78262705e6291ad0d19d28744b53f7bcc8e457c4ffc9db909a710dbf2c6
Opcode Fuzzy Hash: b0339c2a41342be96e7d0daa3db23160d6caad386300062a035e9683d57c5d82
Instruction Fuzzy Hash: E312EF71640215ABEB288F68CC49FEE7BF8EF45B10F144129F516EB2E1DB749981CB90

Function 0009F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0009F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 000DF474
IsIconic.USER32(00000000), ref: 000DF47D
ShowWindow.USER32(00000000,00000009), ref: 000DF48A
SetForegroundWindow.USER32(00000000), ref: 000DF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 000DF4AA
GetCurrentThreadId.KERNEL32 ref: 000DF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 000DF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 000DF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 000DF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 000DF4DE
SetForegroundWindow.USER32(00000000), ref: 000DF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 000DF4F6
keybd_event.USER32(00000012,00000000), ref: 000DF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 000DF50B
keybd_event.USER32(00000012,00000000), ref: 000DF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 000DF519
keybd_event.USER32(00000012,00000000), ref: 000DF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 000DF528
keybd_event.USER32(00000012,00000000), ref: 000DF52D
SetForegroundWindow.USER32(00000000), ref: 000DF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 000DF557

Strings

Shell_TrayWnd, xrefs: 000DF46F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 5617a487109db78db656c91297d509d21b55535f22d0a3d1f6390d0f4cd3749d
Instruction ID: d3f0e28ab01514a1e7d824862ebc47ec3e004722245764bf900e35a4df8cccc6
Opcode Fuzzy Hash: 5617a487109db78db656c91297d509d21b55535f22d0a3d1f6390d0f4cd3749d
Instruction Fuzzy Hash: 41315271A80318BBEB256BB55D4AFFF7E6DEB44B50F108026F601E62D1D6B05D40AEA0

Function 000E1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 000E16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000E170D
Part of subcall function 000E16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000E173A
Part of subcall function 000E16C3: GetLastError.KERNEL32 ref: 000E174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 000E1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 000E12A8
CloseHandle.KERNEL32(?), ref: 000E12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 000E12D1
GetProcessWindowStation.USER32 ref: 000E12EA
SetProcessWindowStation.USER32(00000000), ref: 000E12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 000E1310

Part of subcall function 000E10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,000E11FC), ref: 000E10D4
Part of subcall function 000E10BF: CloseHandle.KERNEL32(?,?,000E11FC), ref: 000E10E9

Strings

, xrefs: 000E125A
winsta0, xrefs: 000E12CC
default, xrefs: 000E130B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 99b92aeccf377eda5c1a66addc5ade0fdef1d5cd493634a7c011e955b9ecc0d4
Instruction ID: 3b73851bee525cfb88937fd0976a675b12b86441897ba7cfacfbc0678dd0dd46
Opcode Fuzzy Hash: 99b92aeccf377eda5c1a66addc5ade0fdef1d5cd493634a7c011e955b9ecc0d4
Instruction Fuzzy Hash: 8181BFB1900289AFDF259FA5DD49FEE7BB9EF08700F148129F910F62A1C7708984CB61

Function 000E0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000E10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 000E1114
Part of subcall function 000E10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,000E0B9B,?,?,?), ref: 000E1120
Part of subcall function 000E10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,000E0B9B,?,?,?), ref: 000E112F
Part of subcall function 000E10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,000E0B9B,?,?,?), ref: 000E1136
Part of subcall function 000E10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 000E114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 000E0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 000E0C00
GetLengthSid.ADVAPI32(?), ref: 000E0C17
GetAce.ADVAPI32(?,00000000,?), ref: 000E0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 000E0C6D
GetLengthSid.ADVAPI32(?), ref: 000E0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 000E0C8C
HeapAlloc.KERNEL32(00000000), ref: 000E0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 000E0CB4
CopySid.ADVAPI32(00000000), ref: 000E0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 000E0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 000E0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 000E0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000E0D45
HeapFree.KERNEL32(00000000), ref: 000E0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000E0D55
HeapFree.KERNEL32(00000000), ref: 000E0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000E0D65
HeapFree.KERNEL32(00000000), ref: 000E0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 000E0D78
HeapFree.KERNEL32(00000000), ref: 000E0D7F

Part of subcall function 000E1193: GetProcessHeap.KERNEL32(00000008,000E0BB1,?,00000000,?,000E0BB1,?), ref: 000E11A1
Part of subcall function 000E1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,000E0BB1,?), ref: 000E11A8
Part of subcall function 000E1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,000E0BB1,?), ref: 000E11B7

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 1bfbb114c73cccb016a68aad6715c3a99315f20756cded3289c118fa421ad705
Instruction ID: 63ad4c22ce1fedd5c2055f9526f6d730d1c34a4826007469e0e68c06f86e1208
Opcode Fuzzy Hash: 1bfbb114c73cccb016a68aad6715c3a99315f20756cded3289c118fa421ad705
Instruction Fuzzy Hash: 66718A7694024AEFDF10DFA5DD44BEEBBB8BF08300F148115F914B6191D7B5AA85CBA0

Function 000FEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0011CC08), ref: 000FEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 000FEB37
GetClipboardData.USER32(0000000D), ref: 000FEB43
CloseClipboard.USER32 ref: 000FEB4F
GlobalLock.KERNEL32(00000000), ref: 000FEB87
CloseClipboard.USER32 ref: 000FEB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 000FEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 000FEBC9
GetClipboardData.USER32(00000001), ref: 000FEBD1
GlobalLock.KERNEL32(00000000), ref: 000FEBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 000FEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 000FEC38
GetClipboardData.USER32(0000000F), ref: 000FEC44
GlobalLock.KERNEL32(00000000), ref: 000FEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 000FEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 000FEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 000FECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 000FECF3
CountClipboardFormats.USER32 ref: 000FED14
CloseClipboard.USER32 ref: 000FED59

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: eda0094632f55e4bae93f90d2cb1baa937498ddb80110fd94bf5305423f26382
Instruction ID: 0aa7d2c2dd13a1e394b533f69db56a336429f62323f7fbba0ea16a3b3caa6477
Opcode Fuzzy Hash: eda0094632f55e4bae93f90d2cb1baa937498ddb80110fd94bf5305423f26382
Instruction Fuzzy Hash: 6B61ED34204345AFD314EF24C884FBA77E4BF84714F088519F58697AA2CB31D986DBA2

Function 000F698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 000F69BE
FindClose.KERNEL32(00000000), ref: 000F6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 000F6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 000F6A75

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 000F6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 000F6ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 000F6B32
%4d%02d%02d%02d%02d%02d, xrefs: 000F6B6A
%4d, xrefs: 000F6BB1
%02d, xrefs: 000F6C00, 000F6C0A, 000F6C5A, 000F6CAA, 000F6CFA, 000F6D4A
%03d, xrefs: 000F6DA2

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 9a7685270fe816b16b6bf23ef90f4cdda125288e7375ad45e7f2a8a06154aa30
Instruction ID: acbbf5764a983dab0eead59628ea50c17b8b59ac5fb0af3855fdf2e7bdcc9bec
Opcode Fuzzy Hash: 9a7685270fe816b16b6bf23ef90f4cdda125288e7375ad45e7f2a8a06154aa30
Instruction Fuzzy Hash: 81D15E72508300AAC714EBA4C881EFBB7ECBF98704F444929F589D7192EB75DA44CB62

Function 000F9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 000F9663
GetFileAttributesW.KERNEL32(?), ref: 000F96A1
SetFileAttributesW.KERNEL32(?,?), ref: 000F96BB
FindNextFileW.KERNEL32(00000000,?), ref: 000F96D3
FindClose.KERNEL32(00000000), ref: 000F96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 000F96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 000F974A
SetCurrentDirectoryW.KERNEL32(00146B7C), ref: 000F9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 000F9772
FindClose.KERNEL32(00000000), ref: 000F977F
FindClose.KERNEL32(00000000), ref: 000F978F

Strings

*.*, xrefs: 000F96F5

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 9a3881b43223c47dcd8e6ac7b3f6ea402d49c0106c748c71160e15e0bea4b876
Instruction ID: 42da4955cbfe76c920e3e4b786649b3e96197279c6838671f278b07ff9ad29ab
Opcode Fuzzy Hash: 9a3881b43223c47dcd8e6ac7b3f6ea402d49c0106c748c71160e15e0bea4b876
Instruction Fuzzy Hash: B831E23264031D6BCB14AFB4DC08BEE77ECAF0A321F148065FA14E24A0DB34DD809A50

Function 000F979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 000F97BE
FindNextFileW.KERNEL32(00000000,?), ref: 000F9819
FindClose.KERNEL32(00000000), ref: 000F9824
FindFirstFileW.KERNEL32(*.*,?), ref: 000F9840
SetCurrentDirectoryW.KERNEL32(?), ref: 000F9890
SetCurrentDirectoryW.KERNEL32(00146B7C), ref: 000F98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 000F98B8
FindClose.KERNEL32(00000000), ref: 000F98C5
FindClose.KERNEL32(00000000), ref: 000F98D5

Part of subcall function 000EDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 000EDB00

Strings

*.*, xrefs: 000F983B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 53565c5cafc403b0a57685c2a333d312dbeb9c5fe72bd043ab4aa1ab8aee6b6a
Instruction ID: ef5771c0dcd5183ab4f9161f7bab48f07196d3f384122f13ebd8be3f7a36e6a9
Opcode Fuzzy Hash: 53565c5cafc403b0a57685c2a333d312dbeb9c5fe72bd043ab4aa1ab8aee6b6a
Instruction Fuzzy Hash: 8331F43154021D6EDB24EFB4DC48BEE77ACEF46361F148165F910A24A1DB34DE86DB60

Function 0010BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0010C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0010B6AE,?,?), ref: 0010C9B5
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010C9F1
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010CA68
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0010BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0010BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0010BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0010C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0010C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0010C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0010C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0010C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0010C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0010C382
RegCloseKey.ADVAPI32(00000000), ref: 0010C38F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 1e04c7e5a7db2c2e00d1362cedffaa90ff6acdb5c67ba1bee57c749b2d6c7520
Instruction ID: 4e29a3dd1d61704b8f34096f682a49ae68950fe619502a58f42f4bdb9104cd92
Opcode Fuzzy Hash: 1e04c7e5a7db2c2e00d1362cedffaa90ff6acdb5c67ba1bee57c749b2d6c7520
Instruction Fuzzy Hash: B1024B706042009FD714DF24C895E6ABBE5FF49304F19859DF88ACB2A2DB71ED45CB91

Function 000F8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 000F8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 000F8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 000F8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 000F8310
SetCurrentDirectoryW.KERNEL32(?), ref: 000F8324
SetCurrentDirectoryW.KERNEL32(?), ref: 000F8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 000F838C
SetCurrentDirectoryW.KERNEL32(?), ref: 000F8395

Strings

*.*, xrefs: 000F839B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: d373c34943de4eb4041fbed0dbc1c2d03a8a003b6003befa82bfb586250c8cd6
Instruction ID: 825b0f46c9c904956406500ec7c4c69c16ae69dd290c5f57fdb09389ca57f43b
Opcode Fuzzy Hash: d373c34943de4eb4041fbed0dbc1c2d03a8a003b6003befa82bfb586250c8cd6
Instruction Fuzzy Hash: A0618CB25047499FC710EF60C8449EEB3E8FF89314F04892EFA9997652DB31E945CB92

Function 000ED076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00083AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00083A97,?,?,00082E7F,?,?,?,00000000), ref: 00083AC2

Part of subcall function 000EE199: GetFileAttributesW.KERNEL32(?,000ECF95), ref: 000EE19A

FindFirstFileW.KERNEL32(?,?), ref: 000ED122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 000ED1DD
MoveFileW.KERNEL32(?,?), ref: 000ED1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 000ED20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 000ED237

Part of subcall function 000ED29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,000ED21C,?,?), ref: 000ED2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 000ED253
FindClose.KERNEL32(00000000), ref: 000ED264

Strings

\*.*, xrefs: 000ED0CD, 000ED0D6, 000ED0EB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 5475792c16457f505a5ae338e7bcdde3175658ef476d10dfbe964d4b5e6c6ca9
Instruction ID: 9dcef9c56e06524e198cd05169c2ba82c3f64bc5fde422770309d0dcbaabbdd8
Opcode Fuzzy Hash: 5475792c16457f505a5ae338e7bcdde3175658ef476d10dfbe964d4b5e6c6ca9
Instruction Fuzzy Hash: FF614931805149AECF05FBE1CA529FDB7B5AF65300F64416AE44277192EB319F09CB61

Function 000FED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 000FED91
EmptyClipboard.USER32 ref: 000FED97
GlobalAlloc.KERNEL32(00000002,?), ref: 000FEDAC
CloseClipboard.USER32 ref: 000FEEA3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 501287215a43342c7b14063f638d59fbfe22926d984bd0f0fb6d44f6a5629137
Instruction ID: 27982d47cf4dbf99dda8596a7a83d0da6194c98ab315ab097d2a77dbe8aabe59
Opcode Fuzzy Hash: 501287215a43342c7b14063f638d59fbfe22926d984bd0f0fb6d44f6a5629137
Instruction Fuzzy Hash: 8E41AC35204651AFE324DF15E888B69BBE5BF44328F14C0A9E5598BB72C735EC81CBD0

Function 000EE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 000E16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000E170D
Part of subcall function 000E16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000E173A
Part of subcall function 000E16C3: GetLastError.KERNEL32 ref: 000E174A

ExitWindowsEx.USER32(?,00000000), ref: 000EE932

Strings

@, xrefs: 000EE925
SeShutdownPrivilege, xrefs: 000EE902
, xrefs: 000EE920
, xrefs: 000EE95C

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: aba28c001abfad1d735f7481cea61c4c4d7f646931938f6f3dd5344b7db11ceb
Instruction ID: f7c9c1240443cc14245ebbdaae96ad1406fcd27540ec34ef9e72e0de3f0208af
Opcode Fuzzy Hash: aba28c001abfad1d735f7481cea61c4c4d7f646931938f6f3dd5344b7db11ceb
Instruction Fuzzy Hash: BE012672610299AFEBA462B6DC86FFF72DC9714740F144421F802F31E3E6A09C8481E0

Function 00101204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00101276
WSAGetLastError.WSOCK32 ref: 00101283
bind.WSOCK32(00000000,?,00000010), ref: 001012BA
WSAGetLastError.WSOCK32 ref: 001012C5
closesocket.WSOCK32(00000000), ref: 001012F4
listen.WSOCK32(00000000,00000005), ref: 00101303
WSAGetLastError.WSOCK32 ref: 0010130D
closesocket.WSOCK32(00000000), ref: 0010133C

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: e6e76eb70143fbb47f52a3523d5fcb2b90631e48cbd9472737bfbd8c55aa241d
Instruction ID: 7e5ca803aba78d551d1bffb56e829992cb284b6cb8556051b639f20a93f1657d
Opcode Fuzzy Hash: e6e76eb70143fbb47f52a3523d5fcb2b90631e48cbd9472737bfbd8c55aa241d
Instruction Fuzzy Hash: 38419231600110AFD714DF68C584B69BBE6BF46318F288198E8968F2D7C7B5EC81CBE1

Function 000ED3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00083AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00083A97,?,?,00082E7F,?,?,?,00000000), ref: 00083AC2

Part of subcall function 000EE199: GetFileAttributesW.KERNEL32(?,000ECF95), ref: 000EE19A

FindFirstFileW.KERNEL32(?,?), ref: 000ED420
DeleteFileW.KERNEL32(?,?,?,?), ref: 000ED470
FindNextFileW.KERNEL32(00000000,00000010), ref: 000ED481
FindClose.KERNEL32(00000000), ref: 000ED498
FindClose.KERNEL32(00000000), ref: 000ED4A1

Strings

\*.*, xrefs: 000ED3F2

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 5c9ca14047a2024fd9c0793c2e6d4a3c4fd65839da42e0365c4e8168c212231f
Instruction ID: ed74945eaedd13a7b957fbb8f57f6ea4e70cee5096d4213297f5ae4472be71eb
Opcode Fuzzy Hash: 5c9ca14047a2024fd9c0793c2e6d4a3c4fd65839da42e0365c4e8168c212231f
Instruction Fuzzy Hash: C1313E710083859FC205FF64D8518EF77E8BFA6314F444A1EF4D162192EB30AA098763

Function 000BE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 000BE645

Strings

1#INF, xrefs: 000BF852
1#IND, xrefs: 000BF83D
1#QNAN, xrefs: 000BF84B
1#SNAN, xrefs: 000BF844

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e248a312aaa110503069fb610dad51880dce8abf84ecc74d5c56e99b89c0e02f
Instruction ID: 032fc2c3a952e09349e41f46160e12ce69322e5a0d560f68900ea03c48265d89
Opcode Fuzzy Hash: e248a312aaa110503069fb610dad51880dce8abf84ecc74d5c56e99b89c0e02f
Instruction Fuzzy Hash: 03C23872E086298FDB65CE28DD407EAB7F5EB49305F1441EAD84EE7241E774AE818F40

Function 000F648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000F64DC
CoInitialize.OLE32(00000000), ref: 000F6639
CoCreateInstance.OLE32(0011FCF8,00000000,00000001,0011FB68,?), ref: 000F6650
CoUninitialize.OLE32 ref: 000F68D4

Strings

.lnk, xrefs: 000F64BA, 000F6524, 000F65E0

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 5644946d29408416a476b306afc2126b1dffc3dfa6edbf27c3b3f2bf511906ad
Instruction ID: 322de80e2f1b443421a29bb1d6b5dc0475f70aab17fbe85eabceda23fd9820c3
Opcode Fuzzy Hash: 5644946d29408416a476b306afc2126b1dffc3dfa6edbf27c3b3f2bf511906ad
Instruction Fuzzy Hash: D7D15971508205AFD304EF24C881EABB7E8FF94704F14496DF5959B2A2EB71E905CBA2

Function 001022DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 001022E8

Part of subcall function 000FE4EC: GetWindowRect.USER32(?,?), ref: 000FE504

GetDesktopWindow.USER32 ref: 00102312
GetWindowRect.USER32(00000000), ref: 00102319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00102355
GetCursorPos.USER32(?), ref: 00102381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 001023DF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 968810dfd16b8863c66576fffc5e1dcee0ae0ca6513f9dd6060713f1bbb36772
Instruction ID: ad3da16393511d48c8145e7cdb56a20b5fd65f96578290d81b32bc8d2d1d4908
Opcode Fuzzy Hash: 968810dfd16b8863c66576fffc5e1dcee0ae0ca6513f9dd6060713f1bbb36772
Instruction Fuzzy Hash: FE31E272504355AFC724DF15C849B9BBBEAFF88310F004919F985AB191DB74E948CBD2

Function 000F9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 000F9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 000F9C8B

Part of subcall function 000F3874: GetInputState.USER32 ref: 000F38CB
Part of subcall function 000F3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000F3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 000F9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 000F9C75

Strings

*.*, xrefs: 000F9B5D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 1d66ea326370aa7a6ac12a1e048fd3b425a168d35d8be8d1c02b9adcb6b9bb62
Instruction ID: 0976c017331edccd87b1d5da156ee8cb6941abc64e38eef6c4782933ce4957c7
Opcode Fuzzy Hash: 1d66ea326370aa7a6ac12a1e048fd3b425a168d35d8be8d1c02b9adcb6b9bb62
Instruction Fuzzy Hash: 6F415C7194420EABCF54EFA4C985BEEBBF8FF05310F244056E905A2591EB309E84DFA1

Function 0009997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00099BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00099BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00099A4E
GetSysColor.USER32(0000000F), ref: 00099B23
SetBkColor.GDI32(?,00000000), ref: 00099B36

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 5684a5e6cff9229fca6cd16a6733fcfe3f73d1dc91935a2a78ca008ee4c3cdab
Instruction ID: bad8f50f32a1183c572048cb1d162d4cd10a1bc284bde84565e1acf61721cff3
Opcode Fuzzy Hash: 5684a5e6cff9229fca6cd16a6733fcfe3f73d1dc91935a2a78ca008ee4c3cdab
Instruction Fuzzy Hash: 38A10770208604BFEF799A3C8C98EBF26DDEB46300B15411EF512DAAD1DB259D41E2B3

Function 00101806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0010304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0010307A
Part of subcall function 0010304E: _wcslen.LIBCMT ref: 0010309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0010185D
WSAGetLastError.WSOCK32 ref: 00101884
bind.WSOCK32(00000000,?,00000010), ref: 001018DB
WSAGetLastError.WSOCK32 ref: 001018E6
closesocket.WSOCK32(00000000), ref: 00101915

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: a2a311b2c1eadf4fc58782ce0b6a320ced7b4f770e3aeaf59cc39652a8e9cbc5
Instruction ID: 7770c8a4d986f7e8ce49ea7c5a1a6440c76169f4be8216eaf70241212e32eca4
Opcode Fuzzy Hash: a2a311b2c1eadf4fc58782ce0b6a320ced7b4f770e3aeaf59cc39652a8e9cbc5
Instruction Fuzzy Hash: 2B519371A00210AFEB10AF24C886FAA77E5AB44718F54C058FA595F2D3C775AD418BA1

Function 00111C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00111CC0
IsWindowEnabled.USER32 ref: 00111CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00111CDB
IsIconic.USER32 ref: 00111CE9
IsZoomed.USER32 ref: 00111CF7

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: d5c3c4256022024a02f41be73fde187ea8c61518acc41f38e83c88c3c6c73e07
Instruction ID: 8fec8a2f9ab39ee1c53b879466c994c1891c558156d0436b5c6363532d375bde
Opcode Fuzzy Hash: d5c3c4256022024a02f41be73fde187ea8c61518acc41f38e83c88c3c6c73e07
Instruction Fuzzy Hash: E221D6317802116FE7288F1AD844B9ABBA5FF95314B198078E9498B352C771DC82CBD0

Function 00088060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 000883FA
VUUU, xrefs: 000883E8
VUUU, xrefs: 0008843C
VUUU, xrefs: 000C5DF0
ERCP, xrefs: 0008813C

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 3f019e1a713a4e034e2a1416670969b2d3bed22cddbacf70d83d69380bb29270
Instruction ID: 9805873552a416f3b216dbbd0e89d66d52bbbd3cdb7100e41e40720497f0a3d0
Opcode Fuzzy Hash: 3f019e1a713a4e034e2a1416670969b2d3bed22cddbacf70d83d69380bb29270
Instruction Fuzzy Hash: 1DA28F75E0061ACBDF74DF58C844BAEB7B1BF54310F6481AAE855A7281EB319E81CB50

Function 0010A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0010A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0010A6BA

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Process32NextW.KERNEL32(00000000,?), ref: 0010A79C
CloseHandle.KERNEL32(00000000), ref: 0010A7AB

Part of subcall function 0009CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,000C3303,?), ref: 0009CE8A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: d9613961909a5dfe17baff352743c655b86297e08793bb8d13792a076c33f066
Instruction ID: c929a95d3803df3c9e0f3f6bd93e6827dca0707520f9144aaa5ff7f4561b6f90
Opcode Fuzzy Hash: d9613961909a5dfe17baff352743c655b86297e08793bb8d13792a076c33f066
Instruction Fuzzy Hash: 66514B71508311AFD710EF24C886AABBBE8FF89754F40892DF5C597292EB71D904CB92

Function 000EAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 000EAAAC
SetKeyboardState.USER32(00000080), ref: 000EAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 000EAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 000EAB88

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 7d0c09464058b2920a15a61c4afceb1b1f8feaed344d410de91d6d08d005c75c
Instruction ID: f2466028ede8789cee73402551e594f23d263675bd574655b9ac68490f71854f
Opcode Fuzzy Hash: 7d0c09464058b2920a15a61c4afceb1b1f8feaed344d410de91d6d08d005c75c
Instruction Fuzzy Hash: 2731FC70B40288AEFF358A66CC05BFE77E6AB5A310F04421AF581B61D2D375A985C752

Function 000BBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000BBB7F

Part of subcall function 000B29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000), ref: 000B29DE
Part of subcall function 000B29C8: GetLastError.KERNEL32(00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000,00000000), ref: 000B29F0

GetTimeZoneInformation.KERNEL32 ref: 000BBB91
WideCharToMultiByte.KERNEL32(00000000,?,0015121C,000000FF,?,0000003F,?,?), ref: 000BBC09
WideCharToMultiByte.KERNEL32(00000000,?,00151270,000000FF,?,0000003F,?,?,?,0015121C,000000FF,?,0000003F,?,?), ref: 000BBC36

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 3fd7187676d25f2985078e7cb8143678b8aa7a62ddaf96bd96530ec62f522055
Instruction ID: bbff5909e8e0c30f1d75b667e8a2b7b0f48ac2db79248627c2b495ade5ea27fb
Opcode Fuzzy Hash: 3fd7187676d25f2985078e7cb8143678b8aa7a62ddaf96bd96530ec62f522055
Instruction Fuzzy Hash: ED31D270944205EFCB12DF68CC809ADBFF8FF45710B24466AE020EB6A2D7B09E80CB50

Function 000FCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 000FCE89
GetLastError.KERNEL32(?,00000000), ref: 000FCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 000FCEFE

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: b3697845bcd713076469b0079b009377ef1a1abf351a246d781a16e377c22c02
Instruction ID: 542ff4ba828f9761eac941c8e37c1b645933bd1f5e90ee98d836dca759f766ff
Opcode Fuzzy Hash: b3697845bcd713076469b0079b009377ef1a1abf351a246d781a16e377c22c02
Instruction Fuzzy Hash: 7421AE7154070D9BE730CFA5CA46FAAB7F8EB40354F10842AE64692951E770EE489B90

Function 000E8298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 000E82AA

Strings

(, xrefs: 000E82F0
|, xrefs: 000E82DA

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 7e465444abbce35fd36adb43de877987290b3e7493ec1abf031076e597a6ca7c
Instruction ID: 6c49c93b19552786585447d2f1e69e79d99a9592bf134503afdb571d573b0664
Opcode Fuzzy Hash: 7e465444abbce35fd36adb43de877987290b3e7493ec1abf031076e597a6ca7c
Instruction Fuzzy Hash: 3A322774A047459FCB28CF69C481A6AB7F0FF48710B15C56EE59AEB3A1EB70E941CB40

Function 000F5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 000F5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 000F5D17
FindClose.KERNEL32(?), ref: 000F5D5F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 2d9bb29cef567a0900bbc095ec7f8f2c1ac07325e74f7af265eb52d78e6fd1e2
Instruction ID: 30b520f9fc29017a4ffeb431b355fc8738ab47c36c8c627a2af96ee8cce6fbfb
Opcode Fuzzy Hash: 2d9bb29cef567a0900bbc095ec7f8f2c1ac07325e74f7af265eb52d78e6fd1e2
Instruction Fuzzy Hash: A451AE34604A059FD714DF28C894EAAB7E4FF4A314F14855DEA9A8B7A2CB30ED44CF91

Function 000B2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 000B271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000B2724
UnhandledExceptionFilter.KERNEL32(?), ref: 000B2731

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6289dbf3211835fa16d794a6201ac85ba9169842065b8bed813614465081a0bd
Instruction ID: c6ad9ed812e481b602aa913715fc71077a028cccb03623977e00e92b8bcb2d59
Opcode Fuzzy Hash: 6289dbf3211835fa16d794a6201ac85ba9169842065b8bed813614465081a0bd
Instruction Fuzzy Hash: E131C47595121C9BCB61DF68DD887D8B7B8AF18310F5041EAE41CA7261EB309F818F45

Function 000F51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000F51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 000F5238
SetErrorMode.KERNEL32(00000000), ref: 000F52A1

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: dee61d682ac8670ca8c06e3e8efcac062174d587c794a39353368ac535cbb428
Instruction ID: 9d3497f53ff3b57e09adf885ce0e545c76d04ea243919ef0712351007c200daf
Opcode Fuzzy Hash: dee61d682ac8670ca8c06e3e8efcac062174d587c794a39353368ac535cbb428
Instruction Fuzzy Hash: EE312975A00518DFDB00EF54D884EADBBB4FF49318F088099E949AB262DB31E855CBA0

Function 000E16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0009FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 000A0668
Part of subcall function 0009FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 000A0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000E170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000E173A
GetLastError.KERNEL32 ref: 000E174A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 23d9c36a0ca51be7255fa69b0a08204403d42f37ab61c94c0b9b0d22a9d95892
Instruction ID: bd50199f4395319c68e909c9afdc23a065d63335d653f5f887f61f00b0deec8a
Opcode Fuzzy Hash: 23d9c36a0ca51be7255fa69b0a08204403d42f37ab61c94c0b9b0d22a9d95892
Instruction Fuzzy Hash: 4D11C1B2414305AFD7189F54DC86DABB7F9EB04714B20852EF09697641EB70BC41CA60

Function 000ED5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 000ED608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 000ED645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 000ED650

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 2cd839e537be4cd0adbc2622bd71b2d2c7320bcb95f95476843033f65f103c22
Instruction ID: d5ccf2b1b8c4b73b2d3cfccd45a1f2d672e7f553035ca0efeeaf9ad5a313de1d
Opcode Fuzzy Hash: 2cd839e537be4cd0adbc2622bd71b2d2c7320bcb95f95476843033f65f103c22
Instruction Fuzzy Hash: E2117C71E41228BFDB208F959C44FEFBBBCEB45B50F108112F914E7290C2704A018BE1

Function 000E1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 000E168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 000E16A1
FreeSid.ADVAPI32(?), ref: 000E16B1

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 7e9da84ddb22e4a87faefe5fd96d8d6825f3a33da382a915df9bf6ebdb580d62
Instruction ID: 95cf7d9bffc4195431c86788dcbb1b346554cfd5f1c3497fe9dbd22423f470bc
Opcode Fuzzy Hash: 7e9da84ddb22e4a87faefe5fd96d8d6825f3a33da382a915df9bf6ebdb580d62
Instruction Fuzzy Hash: E5F0F475990309FBDB00DFE49D89EEEBBBCEB08604F508565E501E2181E774AA448A90

Function 000A4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000B28E9,?,000A4CBE,000B28E9,001488B8,0000000C,000A4E15,000B28E9,00000002,00000000,?,000B28E9), ref: 000A4D09
TerminateProcess.KERNEL32(00000000,?,000A4CBE,000B28E9,001488B8,0000000C,000A4E15,000B28E9,00000002,00000000,?,000B28E9), ref: 000A4D10
ExitProcess.KERNEL32 ref: 000A4D22

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 04111bb57a0692bcf15d74ef3f116de567a287509ed9593d1d55e76d8bc084c0
Instruction ID: 1d64b0a14282e3bd213ff78d50b9b19287f1a61cf933169fee32f4af901338c6
Opcode Fuzzy Hash: 04111bb57a0692bcf15d74ef3f116de567a287509ed9593d1d55e76d8bc084c0
Instruction Fuzzy Hash: 56E0B635050148ABCF15AF94DE09AD87B69FB82785B108014FD158A523DB75DE82CA80

Function 000DD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 000DD28C

Strings

X64, xrefs: 000DD2A8

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 54680bd4bd6acb38a3f593c0a785dd75007bea29326881b706a5fc2fe6641f4d
Instruction ID: 1bde24b66361a879d7891dc2a1feed8c2eb2a34eec9678623d5b7e328c4c701a
Opcode Fuzzy Hash: 54680bd4bd6acb38a3f593c0a785dd75007bea29326881b706a5fc2fe6641f4d
Instruction Fuzzy Hash: 8DD0C9B484121DEACFA4CB90DC88DDDB37CBB14345F104152F146A2100D73095489F20

Function 000ACAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 73ae59b3fe0bc185b992b2408c2ed3b48c5f63c7bf71b51f6d36c8bf7c23bcea
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 32021D71E002199FEF14CFA9C880AADFBF1EF49324F258169D919E7385D731AD418B94

Function 000F68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 000F6918
FindClose.KERNEL32(00000000), ref: 000F6961

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 57262118ba17aaf08062105a3bcf87a87e4f733ba9ed419d6ef1997df0f2b5b1
Instruction ID: 17a684d0efb9d27c05bebd6daa8a4cfecd3e7edf19fa86d6cd1fdb5d4074e651
Opcode Fuzzy Hash: 57262118ba17aaf08062105a3bcf87a87e4f733ba9ed419d6ef1997df0f2b5b1
Instruction Fuzzy Hash: 0711D0316082109FD710DF29D484A26BBE5FF85328F14C6A9E5698F6A2CB71EC45CB90

Function 000F37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00104891,?,?,00000035,?), ref: 000F37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00104891,?,?,00000035,?), ref: 000F37F4

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 76051f18cf25f7e3d1778db813bb284f09b0759a91c2cb17805db0c5a50aee8e
Instruction ID: 85678e76e3cb3aa532d99a6271d175258a98881f58153ded879e0c98daf4d7b5
Opcode Fuzzy Hash: 76051f18cf25f7e3d1778db813bb284f09b0759a91c2cb17805db0c5a50aee8e
Instruction Fuzzy Hash: D7F0E5B06083282AE72027669C4DFEB3AAEEFC5771F000175F609D2682D9A09984C7F0

Function 000EB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 000EB25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 000EB270

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 7562df6da0fd9156caea4750daee0afdea6182b1c3e441710f7f82bd43f5001a
Instruction ID: bfe74153dfb559b5d2e3446e4f866e353ae5c1f98a4c5b6843c8be15f54bdfaf
Opcode Fuzzy Hash: 7562df6da0fd9156caea4750daee0afdea6182b1c3e441710f7f82bd43f5001a
Instruction Fuzzy Hash: CEF01D7194428EAFDB159FA1C805BEE7BB4FF04305F00800AF955A5191C77986519F94

Function 000E10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,000E11FC), ref: 000E10D4
CloseHandle.KERNEL32(?,?,000E11FC), ref: 000E10E9

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 18542b4418d4f01b2e4ad779dd669c59e095d405f2cf4c5ee28860c58ca2cbfe
Instruction ID: cbc48bfbd9a1e3dc157373055d258b2fdcd83ec7f27c90da04d30ee17a16c3df
Opcode Fuzzy Hash: 18542b4418d4f01b2e4ad779dd669c59e095d405f2cf4c5ee28860c58ca2cbfe
Instruction Fuzzy Hash: 0CE0BF72058611AFEB252B51FD05EB777E9EB04310B24C82DF5A5804B1DB726CD0EB50

Function 0008CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 000D0C40

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 7fe13bc47dc9d424d3c681b87b7620ca0e1b5fc59ec50109bfb332eda8170a91
Instruction ID: bc32cab60c92089540737886ee29e1f655eb767cdeaeb9fd91601d40b2950140
Opcode Fuzzy Hash: 7fe13bc47dc9d424d3c681b87b7620ca0e1b5fc59ec50109bfb332eda8170a91
Instruction Fuzzy Hash: C3325B70900318DBEF24EF94D881FEDB7B5BF05304F14806AE98AAB292D775AD45CB61

Function 000B676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,000B6766,?,?,00000008,?,?,000BFEFE,00000000), ref: 000B6998

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 113a30bbf09a4ad5d1c0fd48df550c7b59d2282f195d2bfbeb9d7b37478251aa
Instruction ID: 83323c766bed9c7aa74c7ddfde987c03ae3aff3a6f4c92b9cca622ea4119eaa0
Opcode Fuzzy Hash: 113a30bbf09a4ad5d1c0fd48df550c7b59d2282f195d2bfbeb9d7b37478251aa
Instruction Fuzzy Hash: A8B14D31510608DFDB55CF28C486BA57BE0FF45364F298658E899CF2A2C73AE991CF40

Function 0009B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 000D851F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5762cbc03abbb18d59e9bd932689a91cb164cde3d2ed71cfcbacd687700fbfa6
Instruction ID: d21901a171d712a7e1559329309d50e9263ada8962b2f55f0ad0f9dcfce60764
Opcode Fuzzy Hash: 5762cbc03abbb18d59e9bd932689a91cb164cde3d2ed71cfcbacd687700fbfa6
Instruction Fuzzy Hash: E91250719002299BCF64CF58D9816EEB7F5FF48710F1481AAE849EB255DB309E81DFA0

Function 000FEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 000FEABD

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 81edbcf26d3ae7c7098cfce7e3fd13a88ca6d56fc7e46bdf4d4b17f82458e78a
Instruction ID: 60e933141769de00b3897f9fa92063abe066dd069d99bfbaca7113b895e54e26
Opcode Fuzzy Hash: 81edbcf26d3ae7c7098cfce7e3fd13a88ca6d56fc7e46bdf4d4b17f82458e78a
Instruction Fuzzy Hash: E4E04F312002149FD710EF59D804E9AFBE9BF98760F008426FD49C7762DB70F8408BA1

Function 000A09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,000A03EE), ref: 000A09DA

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 76e7ef7d279392fbc74b9feab27163a5d2abb489fffebd319ffaffbcba717f95
Instruction ID: 9f97e2d9c13a96d1bc434b1030ec0e1e0f810483272e3232abb3c1d341a86a4a
Opcode Fuzzy Hash: 76e7ef7d279392fbc74b9feab27163a5d2abb489fffebd319ffaffbcba717f95
Instruction Fuzzy Hash:

Function 000A781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 000A798B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 3856a61d9ca5074bcd040aae3a6fb17492d9419b256485c787458efbb1547b25
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 7851776268C6056BDBB885E88C597FF23C99B53340F18C51AD88EC7283CE19DE05D352

Function 000B6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7db232c7b343057f32c5ff428c16061aeb5b0c4732a4139067f1d8a0a7ac12a
Instruction ID: c89f56978d3a125657a1027d89e2b12bd3c1774abfb8c6ea630e0b7c4836473b
Opcode Fuzzy Hash: f7db232c7b343057f32c5ff428c16061aeb5b0c4732a4139067f1d8a0a7ac12a
Instruction Fuzzy Hash: 1B321222D29F015DD7339634C82233AA689AFB73C5F15D737E81AB5DA6EB29C4C35100

Function 0009CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e7676e7313cb51033483db61af4e06411b0df46b2f456349751fb8581af8174
Instruction ID: 2300e91583ddeb4b4cdab3516a559f499c0c4eac4cfd69c2bb015ef6059b6147
Opcode Fuzzy Hash: 3e7676e7313cb51033483db61af4e06411b0df46b2f456349751fb8581af8174
Instruction Fuzzy Hash: 8D322371A043468BFF78CA68C494E7D7BE1EB45314F28856BD49ACB391D230DD81EB61

Function 00087920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a1178561e9f781c0c6bec54287a33850c55449515a09b93bd52ea883bd45ec
Instruction ID: 9d38a0e1d19aed8cadb5f2add4ac25d1bffeb9fa440f199932695339af018520
Opcode Fuzzy Hash: 38a1178561e9f781c0c6bec54287a33850c55449515a09b93bd52ea883bd45ec
Instruction Fuzzy Hash: 9522AE74A0460A9FDF14DFA4C881BEEB7F6FF44300F244529E856A7291EB36EA51CB50

Function 000891C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2a9990961eaf4411c38592f88e7b1f220d04c1bdead89861735dd47c256838
Instruction ID: 16c5a7204c4bb44bca9d1440be2501978f9d88170dbaecd01c59ebb2d1992799
Opcode Fuzzy Hash: 6e2a9990961eaf4411c38592f88e7b1f220d04c1bdead89861735dd47c256838
Instruction Fuzzy Hash: 3F02A4B0A0020AEFDF14EF54D881BAEB7B5FF44300F158169E856DB291EB31AE51DB91

Function 000B9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c55febc122f8f95cf052286408edc4f16e99af14c365e31a5e203d0bff9e31
Instruction ID: af3ed3682f3ac5546b74064130f3b0f21b71eeba4c1e6f4d78a24c2d96affc65
Opcode Fuzzy Hash: 66c55febc122f8f95cf052286408edc4f16e99af14c365e31a5e203d0bff9e31
Instruction Fuzzy Hash: DAB1FF20E2AF405DC22396398835336B69CBFBB6D5F91D71BFC2674D22EB2686D34140

Function 000A1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 8a48decaa2e8ae9f4a49c255f80861ba32f43ba6ac0515066419a75183e4f762
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: AF9165722080A34ADB6986BE85740BEFFE15F933B1B1A079DD4F2CA1C5FE249954D620

Function 000A1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: d92ca733108caf3c00bc344925199a0ae5918daa0e2f1bff5ecf3b797a9ad9fc
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: D79154722090E34DDBA942BD857447EFFE15B933A171A07BDE4F2CA1C6EE248564E620

Function 000A19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: abebc7abf7dfdf7affb25862162154e56f5aac18af6c97fd6247a85b23b1d731
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: D69144722090A34EDBAD46BA85740BEFFE15B933A2B1E079DD4F2CA1C1FE24C555D620

Function 000A7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed6b4cc33c10af53fb601c6239d666ed7e9a39fdbbad63e10d6a6af2c6ac6ec
Instruction ID: a5e9e19d049fc1853a08cec7712c1e494d76e5f47873adf1ca1ba302714661ad
Opcode Fuzzy Hash: 7ed6b4cc33c10af53fb601c6239d666ed7e9a39fdbbad63e10d6a6af2c6ac6ec
Instruction Fuzzy Hash: 10617BB131870966DAB499E88C95BFF23D8DF93340F14C91DE94ECB282D7119E42C366

Function 000A7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b4fa3c1bbdd1fc23d8c8d8fa22c575cf8cc93f66d6caa9ea6d99cda7fa32c6e
Instruction ID: 242a6aaa97026afd88e08314b5fda1f50f85f5666b7258c5ea3b7683813e21a0
Opcode Fuzzy Hash: 2b4fa3c1bbdd1fc23d8c8d8fa22c575cf8cc93f66d6caa9ea6d99cda7fa32c6e
Instruction Fuzzy Hash: 4C617A7160870956DEB88AE84C65BFF23F8EF47700F14C959E94FDF282EA129D428355

Function 000A1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: d718220222310adcafec7412a763e980eb8841461cca7f105fe3b4effc325afc
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 6481637260D0A30DDBAD42BA85344BEFFE15F933A1B1A079DD4F2CA1C1EE24C954E620

Function 000F2046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc85874da260bbfe538e0d0bf02a09cc3865fdd534188e30b513496e6895ab73
Instruction ID: a16e4f61193f7f07c2cd369be4eb0591da505365f314b3e08f2b95f532a76fe7
Opcode Fuzzy Hash: dc85874da260bbfe538e0d0bf02a09cc3865fdd534188e30b513496e6895ab73
Instruction Fuzzy Hash: 0021B7336206158BDB28CF79C8236BE73E5A764310F15862EE4A7C77D1DE39A944DB80

Function 00102ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00102B30
DeleteObject.GDI32(00000000), ref: 00102B43
DestroyWindow.USER32 ref: 00102B52
GetDesktopWindow.USER32 ref: 00102B6D
GetWindowRect.USER32(00000000), ref: 00102B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00102CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00102CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00102CF8
GetClientRect.USER32(00000000,?), ref: 00102D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00102D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00102D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00102D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00102D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00102D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00102D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00102DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00102DA8
GlobalFree.KERNEL32(00000000), ref: 00102DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00102DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0011FC38,00000000), ref: 00102DDB
GlobalFree.KERNEL32(00000000), ref: 00102DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00102E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00102E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00102E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0010303F

Strings

DISPLAY, xrefs: 00102EA2
static, xrefs: 00102D3A, 00102E91
, xrefs: 00102FC5
AutoIt v3, xrefs: 00102CF2

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: f35d36248564fb7e2e11e64f3ead43f03a36992fb5be77d07252f8c7944ef780
Instruction ID: 7d87ae8d94b2971e40d29b9db82516d5c18f7acf3a3cb0ec2f132f1fa89fdbef
Opcode Fuzzy Hash: f35d36248564fb7e2e11e64f3ead43f03a36992fb5be77d07252f8c7944ef780
Instruction Fuzzy Hash: D7027B71900215EFDB18DFA4CD89EEE7BB9FB49711F108158F915AB2A1CB70AD41CBA0

Function 001170D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0011712F
GetSysColorBrush.USER32(0000000F), ref: 00117160
GetSysColor.USER32(0000000F), ref: 0011716C
SetBkColor.GDI32(?,000000FF), ref: 00117186
SelectObject.GDI32(?,?), ref: 00117195
InflateRect.USER32(?,000000FF,000000FF), ref: 001171C0
GetSysColor.USER32(00000010), ref: 001171C8
CreateSolidBrush.GDI32(00000000), ref: 001171CF
FrameRect.USER32(?,?,00000000), ref: 001171DE
DeleteObject.GDI32(00000000), ref: 001171E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00117230
FillRect.USER32(?,?,?), ref: 00117262
GetWindowLongW.USER32(?,000000F0), ref: 00117284

Part of subcall function 001173E8: GetSysColor.USER32(00000012), ref: 00117421
Part of subcall function 001173E8: SetTextColor.GDI32(?,?), ref: 00117425
Part of subcall function 001173E8: GetSysColorBrush.USER32(0000000F), ref: 0011743B
Part of subcall function 001173E8: GetSysColor.USER32(0000000F), ref: 00117446
Part of subcall function 001173E8: GetSysColor.USER32(00000011), ref: 00117463
Part of subcall function 001173E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00117471
Part of subcall function 001173E8: SelectObject.GDI32(?,00000000), ref: 00117482
Part of subcall function 001173E8: SetBkColor.GDI32(?,00000000), ref: 0011748B
Part of subcall function 001173E8: SelectObject.GDI32(?,?), ref: 00117498
Part of subcall function 001173E8: InflateRect.USER32(?,000000FF,000000FF), ref: 001174B7
Part of subcall function 001173E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001174CE
Part of subcall function 001173E8: GetWindowLongW.USER32(00000000,000000F0), ref: 001174DB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 450d124f79d589a6a50ba3372de1d8a7f46faea18180f86869713b89a668385f
Instruction ID: 36175e34b3bdb6371fcf73433aa47436e6f0474787b397b953d3591ec48b9cc2
Opcode Fuzzy Hash: 450d124f79d589a6a50ba3372de1d8a7f46faea18180f86869713b89a668385f
Instruction Fuzzy Hash: 0DA1A272148301FFD7099F60DD48A9B7BBAFB89320F104A29F962961E1D770E985CB91

Function 00098D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00098E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 000D6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 000D6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 000D6F43

Part of subcall function 00098F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00098BE8,?,00000000,?,?,?,?,00098BBA,00000000,?), ref: 00098FC5

SendMessageW.USER32(?,00001053), ref: 000D6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 000D6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 000D6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 000D6FB7

Strings

0, xrefs: 000D6DCF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 46885bfed3c01c9a4285abd7e5c60e8b28437e452499a0669d39429d843321ed
Instruction ID: daa28dbd54bc9dd04bbfcaf33cb8f4f681810a5fb2a194fa994dd2307b832709
Opcode Fuzzy Hash: 46885bfed3c01c9a4285abd7e5c60e8b28437e452499a0669d39429d843321ed
Instruction Fuzzy Hash: FC12AA30604301EFDB65CF24D958BAABBE1FB45314F14846AF4958B762CB32EC91DBA1

Function 00102711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0010273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0010286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 001028A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 001028B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00102900
GetClientRect.USER32(00000000,?), ref: 0010290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00102955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00102964
GetStockObject.GDI32(00000011), ref: 00102974
SelectObject.GDI32(00000000,00000000), ref: 00102978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00102988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00102991
DeleteDC.GDI32(00000000), ref: 0010299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 001029C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 001029DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00102A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00102A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00102A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00102A77
GetStockObject.GDI32(00000011), ref: 00102A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00102A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00102A97

Strings

DISPLAY, xrefs: 0010295A
static, xrefs: 0010294F, 00102A71
AutoIt v3, xrefs: 001028F8
msctls_progress32, xrefs: 00102A13

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 231e87d4d14257ca7ed5a75026cab5fd1b3e930077b46fd44fecd7bcc1d46626
Instruction ID: 2ea65e82e1bca57ab35fc2abe91402023bb5648f8aac15d8ade94bcf4df50933
Opcode Fuzzy Hash: 231e87d4d14257ca7ed5a75026cab5fd1b3e930077b46fd44fecd7bcc1d46626
Instruction Fuzzy Hash: CDB14A71A40215BFEB14DFA8CD49FAE7BA9FB08721F108115F914EB691D7B0AD40CBA0

Function 000F4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000F4AED
GetDriveTypeW.KERNEL32(?,0011CB68,?,\\.\,0011CC08), ref: 000F4BCA
SetErrorMode.KERNEL32(00000000,0011CB68,?,\\.\,0011CC08), ref: 000F4D36

Strings

Network, xrefs: 000F4C02
CDROM, xrefs: 000F4BFB
Fixed, xrefs: 000F4C09
USB, xrefs: 000F4CB4
Removable, xrefs: 000F4C10, 000F4C15
ATAPI, xrefs: 000F4C91
Unknown, xrefs: 000F4BED, 000F4C83
SAS, xrefs: 000F4CC9
MMC, xrefs: 000F4CDE
SSA, xrefs: 000F4CA6
iSCSI, xrefs: 000F4CC2
SSD, xrefs: 000F4C4A
SCSI, xrefs: 000F4C8A
RAID, xrefs: 000F4CBB
FileBackedVirtual, xrefs: 000F4CEC
ATA, xrefs: 000F4C98
PhysicalDrive, xrefs: 000F4B76
RAMDisk, xrefs: 000F4BF4
Fibre, xrefs: 000F4CAD
Virtual, xrefs: 000F4CE5
\\.\, xrefs: 000F4B3F
1394, xrefs: 000F4C9F
SATA, xrefs: 000F4CD0

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f0b08951bac2b324f6f6cd3db7c65aa9ce39be82e0c171dfab3761b6650c7564
Instruction ID: 739b070b1f5439beba611b146f0546385885b06dd1acd7357944474342b32549
Opcode Fuzzy Hash: f0b08951bac2b324f6f6cd3db7c65aa9ce39be82e0c171dfab3761b6650c7564
Instruction Fuzzy Hash: 0D61253060120DDBCB94EF64CA819BE77B1FB45714B248015FD46ABA62CB31DD45FB92

Function 001173E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00117421
SetTextColor.GDI32(?,?), ref: 00117425
GetSysColorBrush.USER32(0000000F), ref: 0011743B
GetSysColor.USER32(0000000F), ref: 00117446
CreateSolidBrush.GDI32(?), ref: 0011744B
GetSysColor.USER32(00000011), ref: 00117463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00117471
SelectObject.GDI32(?,00000000), ref: 00117482
SetBkColor.GDI32(?,00000000), ref: 0011748B
SelectObject.GDI32(?,?), ref: 00117498
InflateRect.USER32(?,000000FF,000000FF), ref: 001174B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001174CE
GetWindowLongW.USER32(00000000,000000F0), ref: 001174DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0011752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00117554
InflateRect.USER32(?,000000FD,000000FD), ref: 00117572
DrawFocusRect.USER32(?,?), ref: 0011757D
GetSysColor.USER32(00000011), ref: 0011758E
SetTextColor.GDI32(?,00000000), ref: 00117596
DrawTextW.USER32(?,001170F5,000000FF,?,00000000), ref: 001175A8
SelectObject.GDI32(?,?), ref: 001175BF
DeleteObject.GDI32(?), ref: 001175CA
SelectObject.GDI32(?,?), ref: 001175D0
DeleteObject.GDI32(?), ref: 001175D5
SetTextColor.GDI32(?,?), ref: 001175DB
SetBkColor.GDI32(?,?), ref: 001175E5

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: f2ef3bac3815e822c38eda0d6e294dcf7e43cc17a74983b0ae4bb3af61e71710
Instruction ID: c66e28defa88844ae7ff5d67b88b3513510a62a9d45406e97cd912eabb4ebd25
Opcode Fuzzy Hash: f2ef3bac3815e822c38eda0d6e294dcf7e43cc17a74983b0ae4bb3af61e71710
Instruction Fuzzy Hash: B4615072944218FFDF099FA4DD49AEE7F7AEB08320F118125F915AB6E1D7709980CB90

Function 00110FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00111128
GetDesktopWindow.USER32 ref: 0011113D
GetWindowRect.USER32(00000000), ref: 00111144
GetWindowLongW.USER32(?,000000F0), ref: 00111199
DestroyWindow.USER32(?), ref: 001111B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 001111ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0011120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0011121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00111232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00111245
IsWindowVisible.USER32(00000000), ref: 001112A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 001112BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 001112D0
GetWindowRect.USER32(00000000,?), ref: 001112E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0011130E
GetMonitorInfoW.USER32(00000000,?), ref: 00111328
CopyRect.USER32(?,?), ref: 0011133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 001113AA

Strings

(, xrefs: 0011131B
tooltips_class32, xrefs: 001111E6
0, xrefs: 001110D3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 56be2fd8be522219063b3ee6a8e8154044679cab546b5fc6fa248f84a2c68ba2
Instruction ID: 2f92cbfdcc018d04ab12f6cd3378e90214d8f7734a188fb7d72a6b7ba3384ab2
Opcode Fuzzy Hash: 56be2fd8be522219063b3ee6a8e8154044679cab546b5fc6fa248f84a2c68ba2
Instruction Fuzzy Hash: 9FB17E71604341AFD718DF64C985BAAFBE4FF88750F008928FA999B2A1D771D884CB91

Function 00098891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00098968
GetSystemMetrics.USER32(00000007), ref: 00098970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0009899B
GetSystemMetrics.USER32(00000008), ref: 000989A3
GetSystemMetrics.USER32(00000004), ref: 000989C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 000989E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 000989F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00098A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00098A3C
GetClientRect.USER32(00000000,000000FF), ref: 00098A5A
GetStockObject.GDI32(00000011), ref: 00098A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00098A81

Part of subcall function 0009912D: GetCursorPos.USER32(?), ref: 00099141
Part of subcall function 0009912D: ScreenToClient.USER32(00000000,?), ref: 0009915E
Part of subcall function 0009912D: GetAsyncKeyState.USER32(00000001), ref: 00099183
Part of subcall function 0009912D: GetAsyncKeyState.USER32(00000002), ref: 0009919D

SetTimer.USER32(00000000,00000000,00000028,000990FC), ref: 00098AA8

Strings

AutoIt v3 GUI, xrefs: 00098A20

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: ac15e4e91d4347036482847f2e3ecd91dab998041ece2f3a2c5e3143e1782a8d
Instruction ID: e0233d27e02546bd295d7b76a507aed7621b1ebb95300ee56e934f3a7948849f
Opcode Fuzzy Hash: ac15e4e91d4347036482847f2e3ecd91dab998041ece2f3a2c5e3143e1782a8d
Instruction Fuzzy Hash: A1B16C71A4020AEFDF14DF68CD45BEE7BB5BB48315F10822AFA15AB390DB34A841DB51

Function 000E0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000E10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 000E1114
Part of subcall function 000E10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,000E0B9B,?,?,?), ref: 000E1120
Part of subcall function 000E10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,000E0B9B,?,?,?), ref: 000E112F
Part of subcall function 000E10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,000E0B9B,?,?,?), ref: 000E1136
Part of subcall function 000E10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 000E114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 000E0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 000E0E29
GetLengthSid.ADVAPI32(?), ref: 000E0E40
GetAce.ADVAPI32(?,00000000,?), ref: 000E0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 000E0E96
GetLengthSid.ADVAPI32(?), ref: 000E0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 000E0EB5
HeapAlloc.KERNEL32(00000000), ref: 000E0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 000E0EDD
CopySid.ADVAPI32(00000000), ref: 000E0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 000E0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 000E0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 000E0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000E0F6E
HeapFree.KERNEL32(00000000), ref: 000E0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000E0F7E
HeapFree.KERNEL32(00000000), ref: 000E0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000E0F8E
HeapFree.KERNEL32(00000000), ref: 000E0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 000E0FA1
HeapFree.KERNEL32(00000000), ref: 000E0FA8

Part of subcall function 000E1193: GetProcessHeap.KERNEL32(00000008,000E0BB1,?,00000000,?,000E0BB1,?), ref: 000E11A1
Part of subcall function 000E1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,000E0BB1,?), ref: 000E11A8
Part of subcall function 000E1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,000E0BB1,?), ref: 000E11B7

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: edf606659e3a43bb595a2542c6802a1f9b68c24df21d70f6eaee9cf1523defea
Instruction ID: 4ab7668c84e75ad293141794cbd8f5e9cbecebd2b7e7209bff3a9971347102bb
Opcode Fuzzy Hash: edf606659e3a43bb595a2542c6802a1f9b68c24df21d70f6eaee9cf1523defea
Instruction Fuzzy Hash: FF717D7294024AEFDF209FA5DD44BEEBBB8BF08300F048125F959B6591D7709D95CBA0

Function 0010C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0010C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0011CC08,00000000,?,00000000,?,?), ref: 0010C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0010C5A4
_wcslen.LIBCMT ref: 0010C5F4
_wcslen.LIBCMT ref: 0010C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0010C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0010C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0010C84D
RegCloseKey.ADVAPI32(?), ref: 0010C881
RegCloseKey.ADVAPI32(00000000), ref: 0010C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0010C960

Strings

REG_MULTI_SZ, xrefs: 0010C6F5
REG_QWORD, xrefs: 0010C8C3
REG_BINARY, xrefs: 0010C913
REG_DWORD, xrefs: 0010C804
REG_SZ, xrefs: 0010C644
REG_EXPAND_SZ, xrefs: 0010C5CD

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: ba402ad3a6dfa3c682eaed81de1188dfdbb983a6fb75d32e041b7e5b764b8634
Instruction ID: 410491d949096d18d7d18483f180861803678b2494e5e400fcde305a6969c0af
Opcode Fuzzy Hash: ba402ad3a6dfa3c682eaed81de1188dfdbb983a6fb75d32e041b7e5b764b8634
Instruction Fuzzy Hash: BA1275352042019FDB14EF24C881B6AB7E5FF88314F15899DF89A9B3A2DB71ED41CB91

Function 0011091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001109C6
_wcslen.LIBCMT ref: 00110A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00110A54
_wcslen.LIBCMT ref: 00110A8A
_wcslen.LIBCMT ref: 00110B06
_wcslen.LIBCMT ref: 00110B81

Part of subcall function 0009F9F2: _wcslen.LIBCMT ref: 0009F9FD

Part of subcall function 000E2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 000E2BFA

Strings

EXPAND, xrefs: 00110BF8
EXISTS, xrefs: 00110B7C, 00110B97
CHECK, xrefs: 00110A85, 00110AA0
GETTOTALCOUNT, xrefs: 001109F2, 00110A17
UNCHECK, xrefs: 00110D3E
GETTEXT, xrefs: 00110C97
GETITEMCOUNT, xrefs: 00110C1E
ISCHECKED, xrefs: 00110CE1
GETSELECTED, xrefs: 00110C4E
COLLAPSE, xrefs: 00110B01, 00110B1C
SELECT, xrefs: 00110D11

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: ed1e2a3588e19ebf900197db5a842085c190682799c47813b73421a1439df5c6
Instruction ID: f75c5a135cd86b5ad586037d0761b2bb6c3396ec5db1dc5bc460adea178f2278
Opcode Fuzzy Hash: ed1e2a3588e19ebf900197db5a842085c190682799c47813b73421a1439df5c6
Instruction Fuzzy Hash: CBE1D2356087418FCB19EF24C4509AAB7E1FF88314B15896CF899AB3A2D771EDC5CB81

Function 0010C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0010B6AE,?,?), ref: 0010C9B5
_wcslen.LIBCMT ref: 0010C9F1
_wcslen.LIBCMT ref: 0010CA68
_wcslen.LIBCMT ref: 0010CA9E
_wcslen.LIBCMT ref: 0010CAF9
_wcslen.LIBCMT ref: 0010CB2F
_wcslen.LIBCMT ref: 0010CB7F

Strings

HKCU, xrefs: 0010CBCE
HKU, xrefs: 0010CBF0
HKLM, xrefs: 0010CA98, 0010CA9D
HKEY_LOCAL_MACHINE, xrefs: 0010CA62, 0010CA67
HKEY_CLASSES_ROOT, xrefs: 0010CAF3, 0010CAF8
HKEY_USERS, xrefs: 0010CBDF
HKCC, xrefs: 0010CBAC
HKEY_CURRENT_CONFIG, xrefs: 0010CB79, 0010CB7E
HKEY_CURRENT_USER, xrefs: 0010CBBD
HKCR, xrefs: 0010CB29, 0010CB2E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: d1db21d288d2559b10429d1b6f2c9a8a66d88b11c3fda35375a8f0a1e06d684e
Instruction ID: 73b8db2e50ad646510356ae5aa138134f64a49376bfd588da4cfb279337af2e9
Opcode Fuzzy Hash: d1db21d288d2559b10429d1b6f2c9a8a66d88b11c3fda35375a8f0a1e06d684e
Instruction Fuzzy Hash: A071033260012A8BCB20DF6CC9515FB3391ABA1790B650724FCD6A72D5F7B0CD448BE0

Function 0011833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0011835A
_wcslen.LIBCMT ref: 0011836E
_wcslen.LIBCMT ref: 00118391
_wcslen.LIBCMT ref: 001183B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 001183F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0011361A,?), ref: 0011844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00118487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 001184CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00118501
FreeLibrary.KERNEL32(?), ref: 0011850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0011851D
DestroyIcon.USER32(?), ref: 0011852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00118549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00118555

Strings

.dll, xrefs: 001183AB
.icl, xrefs: 00118368
.exe, xrefs: 00118388

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 88c7e435bb0fd54b95416f5969f3dfe7e6bc6eb4bd02e485856d7092d9d04f50
Instruction ID: 845eaaaefeec52b9eb501f81dfb184f4ef6e548769007e54d74d959da6e1107f
Opcode Fuzzy Hash: 88c7e435bb0fd54b95416f5969f3dfe7e6bc6eb4bd02e485856d7092d9d04f50
Instruction Fuzzy Hash: F161CF71540215BAEB18DF64CC41BFE77A8FB04B11F108619F915E61D2DFB4E990CBA0

Function 00087778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

", xrefs: 000C5153
#OnAutoItStartRegister, xrefs: 00087817
Bad directive syntax error, xrefs: 000C519A
#comments-start, xrefs: 0008785F, 000878B1
#include, xrefs: 00087847
#requireadmin, xrefs: 000877FF
#include-once, xrefs: 0008782F
#ce, xrefs: 000878ED
#cs, xrefs: 00087873, 000878C5
#notrayicon, xrefs: 000877E7
Unterminated group of comments, xrefs: 000C528C
#comments-end, xrefs: 000878D9
Cannot parse #include, xrefs: 000C5279
#pragma compile, xrefs: 000877D3
', xrefs: 000C5169

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: f4e92f38712c73cad80f40ab219dbcff22bb58b73ed7c29b625a8eab055b23af
Instruction ID: 2889c1bac2eace2893b0a04e6bbebe3682eb7d4fdc651b6ae6454a0413bfb06b
Opcode Fuzzy Hash: f4e92f38712c73cad80f40ab219dbcff22bb58b73ed7c29b625a8eab055b23af
Instruction Fuzzy Hash: 4681D271648605BBDB24BF60DC42FEE77A9BF16300F144038F849AA19BEB70D991D7A1

Function 000F3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 000F3EF8
_wcslen.LIBCMT ref: 000F3F03
_wcslen.LIBCMT ref: 000F3F5A
_wcslen.LIBCMT ref: 000F3F98
GetDriveTypeW.KERNEL32(?), ref: 000F3FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000F401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000F4059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000F4087

Strings

set cd door , xrefs: 000F4028
type cdaudio alias cd wait, xrefs: 000F4001
open , xrefs: 000F3FE5
close, xrefs: 000F3EFE, 000F3F18
wait, xrefs: 000F4044
closed, xrefs: 000F3F08, 000F3F2D, 000F3F46, 000F3F7E, 000F3F97
open, xrefs: 000F3F54, 000F3F59
close cd wait, xrefs: 000F4072

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 7c92d980a23604b8cbc64f7088110ac26c7b8066ec5f5a01cbb433707ae54436
Instruction ID: e2fce1c47ec1eeac5c991152107ba4aa996f06a141822255ea2d5975fbb0df52
Opcode Fuzzy Hash: 7c92d980a23604b8cbc64f7088110ac26c7b8066ec5f5a01cbb433707ae54436
Instruction Fuzzy Hash: 8971AD316042069FC310EF24C8809BBB7F4FF95768B10492DFA9697662EB31DE49CB91

Function 000E5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 000E5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 000E5A40
SetWindowTextW.USER32(?,?), ref: 000E5A57
GetDlgItem.USER32(?,000003EA), ref: 000E5A6C
SetWindowTextW.USER32(00000000,?), ref: 000E5A72
GetDlgItem.USER32(?,000003E9), ref: 000E5A82
SetWindowTextW.USER32(00000000,?), ref: 000E5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 000E5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 000E5AC3
GetWindowRect.USER32(?,?), ref: 000E5ACC
_wcslen.LIBCMT ref: 000E5B33
SetWindowTextW.USER32(?,?), ref: 000E5B6F
GetDesktopWindow.USER32 ref: 000E5B75
GetWindowRect.USER32(00000000), ref: 000E5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 000E5BD3
GetClientRect.USER32(?,?), ref: 000E5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 000E5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 000E5C2F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 3d38eb32614f9e1bf3e17eda1dc982fe43335a3144521806a167f03c7f9f5a47
Instruction ID: 565ee505203a616d82ce43de984bd91c103939c7e0edbe2c41bdac517132e4fc
Opcode Fuzzy Hash: 3d38eb32614f9e1bf3e17eda1dc982fe43335a3144521806a167f03c7f9f5a47
Instruction Fuzzy Hash: B0717E31900B49AFDB24DFA9CE85BAEBBF5FF48709F104918E142B26A0D775E940CB50

Function 000FFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 000FFE27
LoadCursorW.USER32(00000000,00007F8A), ref: 000FFE32
LoadCursorW.USER32(00000000,00007F00), ref: 000FFE3D
LoadCursorW.USER32(00000000,00007F03), ref: 000FFE48
LoadCursorW.USER32(00000000,00007F8B), ref: 000FFE53
LoadCursorW.USER32(00000000,00007F01), ref: 000FFE5E
LoadCursorW.USER32(00000000,00007F81), ref: 000FFE69
LoadCursorW.USER32(00000000,00007F88), ref: 000FFE74
LoadCursorW.USER32(00000000,00007F80), ref: 000FFE7F
LoadCursorW.USER32(00000000,00007F86), ref: 000FFE8A
LoadCursorW.USER32(00000000,00007F83), ref: 000FFE95
LoadCursorW.USER32(00000000,00007F85), ref: 000FFEA0
LoadCursorW.USER32(00000000,00007F82), ref: 000FFEAB
LoadCursorW.USER32(00000000,00007F84), ref: 000FFEB6
LoadCursorW.USER32(00000000,00007F04), ref: 000FFEC1
LoadCursorW.USER32(00000000,00007F02), ref: 000FFECC
GetCursorInfo.USER32(?), ref: 000FFEDC
GetLastError.KERNEL32 ref: 000FFF1E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: caf632caf5f01007eb8b6d73a6c63df5d87ad5dac546ffad0ffff6a672a22c3d
Instruction ID: 1741418475681e7abd77e47e85c960911e1d4dfc0d5cf78fdcc06d612c01a6f9
Opcode Fuzzy Hash: caf632caf5f01007eb8b6d73a6c63df5d87ad5dac546ffad0ffff6a672a22c3d
Instruction Fuzzy Hash: 784153B0D4831AAADB10DFBA8C8586EBFE8FF04354B50453AE11DE7681DB789901CF91

Function 000A00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 000A00C6

Part of subcall function 000A00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0015070C,00000FA0,241A1983,?,?,?,?,000C23B3,000000FF), ref: 000A011C
Part of subcall function 000A00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,000C23B3,000000FF), ref: 000A0127
Part of subcall function 000A00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,000C23B3,000000FF), ref: 000A0138
Part of subcall function 000A00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 000A014E
Part of subcall function 000A00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 000A015C
Part of subcall function 000A00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 000A016A
Part of subcall function 000A00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 000A0195
Part of subcall function 000A00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 000A01A0

___scrt_fastfail.LIBCMT ref: 000A00E7

Part of subcall function 000A00A3: __onexit.LIBCMT ref: 000A00A9

Strings

WakeAllConditionVariable, xrefs: 000A0162
kernel32.dll, xrefs: 000A0133
InitializeConditionVariable, xrefs: 000A0148
SleepConditionVariableCS, xrefs: 000A0154
api-ms-win-core-synch-l1-2-0.dll, xrefs: 000A0122

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: bd96d84aa24c0fded895bac9a0b0d502e4569939c83907bacc28a7c8d265c0c4
Instruction ID: e04e33e06c0b5b3f83afb5756d8652f3c09541da6ea28b068fc824cd7fdc1c54
Opcode Fuzzy Hash: bd96d84aa24c0fded895bac9a0b0d502e4569939c83907bacc28a7c8d265c0c4
Instruction Fuzzy Hash: 9021F932785715ABEB155BE4AD06FE933E4EB4AB51F004139F801D6692DB7498408A90

Function 000E30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000E318D
_wcslen.LIBCMT ref: 000E31F8

Strings

INSTANCE, xrefs: 000E3453
REGEXPCLASS, xrefs: 000E3255, 000E3266
TEXT, xrefs: 000E347C
NAME, xrefs: 000E3335, 000E3346
CLASSNN, xrefs: 000E31F3, 000E3204
CLASS, xrefs: 000E3188, 000E31A5

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: a2ea6864f2dd71c9b59f6212861c9489815c5a714763d006e3e5f89fdd2b4d45
Instruction ID: 335876df9c1b84ae481148ee9a62859602a6fbd54ef4c2fd44f71eb84a63622a
Opcode Fuzzy Hash: a2ea6864f2dd71c9b59f6212861c9489815c5a714763d006e3e5f89fdd2b4d45
Instruction Fuzzy Hash: 6BE1E132A00556AFCB289FB9C449BEEFFB5BF44710F548129E456B7281DB30AF858790

Function 000F44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0011CC08), ref: 000F4527
_wcslen.LIBCMT ref: 000F453B
_wcslen.LIBCMT ref: 000F4599
_wcslen.LIBCMT ref: 000F45F4
_wcslen.LIBCMT ref: 000F463F
_wcslen.LIBCMT ref: 000F46A7

Part of subcall function 0009F9F2: _wcslen.LIBCMT ref: 0009F9FD

GetDriveTypeW.KERNEL32(?,00146BF0,00000061), ref: 000F4743

Strings

removable, xrefs: 000F45EA, 000F45EF
fixed, xrefs: 000F4635, 000F463A
network, xrefs: 000F469D, 000F46A2
cdrom, xrefs: 000F458F, 000F4594
ramdisk, xrefs: 000F46F1
all, xrefs: 000F4531, 000F4536
unknown, xrefs: 000F4708

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 28236c6a7553bded3165be2ebd868ecd613bf91183744ee888da233536a722d5
Instruction ID: 07d3a9b94b400c2f2e12c2afa4623b8eda01d0e3055f535c783c6ac731cd039e
Opcode Fuzzy Hash: 28236c6a7553bded3165be2ebd868ecd613bf91183744ee888da233536a722d5
Instruction Fuzzy Hash: C3B101316083029BC710EF28C890ABFB7E5BFA6724F50491DFA96C7692D730D945DB92

Function 00103FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0011CC08), ref: 001040BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 001040CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0011CC08), ref: 001040F2
FreeLibrary.KERNEL32(00000000,?,0011CC08), ref: 0010413E
StringFromGUID2.OLE32(?,?,00000028,?,0011CC08), ref: 001041A8
SysFreeString.OLEAUT32(00000009), ref: 00104262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 001042C8
SysFreeString.OLEAUT32(?), ref: 001042F2

Strings

kernel32.dll, xrefs: 001040B6
GetModuleHandleExW, xrefs: 001040C7

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: a2a7211bb07ba26c8284ccfae0be25987b75704d0c87cf6a4852196a87f1cbf2
Instruction ID: f7e09d439c7536a659f022e7e30cd6fadff9a5504054e22669b2b523aa20a458
Opcode Fuzzy Hash: a2a7211bb07ba26c8284ccfae0be25987b75704d0c87cf6a4852196a87f1cbf2
Instruction Fuzzy Hash: 51123AB5A00119EFDB14DF94C8C4EAEB7B5BF45314F248098FA45AB291D771ED82CBA0

Function 0008326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00151990), ref: 000C2F8D
GetMenuItemCount.USER32(00151990), ref: 000C303D
GetCursorPos.USER32(?), ref: 000C3081
SetForegroundWindow.USER32(00000000), ref: 000C308A
TrackPopupMenuEx.USER32(00151990,00000000,?,00000000,00000000,00000000), ref: 000C309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 000C30A9

Strings

0, xrefs: 0008327D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: a5ed3006df37e6c5ba5d5d0fb449c874cdd89f415b0c1266483e0ce262613f2e
Instruction ID: 496fa8ecec626dd3349a98220279b653de8fcea10637d47d12e1fa48b073cbe4
Opcode Fuzzy Hash: a5ed3006df37e6c5ba5d5d0fb449c874cdd89f415b0c1266483e0ce262613f2e
Instruction Fuzzy Hash: 9E712671644209BEEB359F28CC49FEEBFA5FF01724F20422AF5146A5E1C7B1A950CB90

Function 00116CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00116DEB

Part of subcall function 00086B57: _wcslen.LIBCMT ref: 00086B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00116E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00116E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00116E94
DestroyWindow.USER32(?), ref: 00116EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00080000,00000000), ref: 00116EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00116EFD
GetDesktopWindow.USER32 ref: 00116F16
GetWindowRect.USER32(00000000), ref: 00116F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00116F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00116F4D

Part of subcall function 00099944: GetWindowLongW.USER32(?,000000EB), ref: 00099952

Strings

tooltips_class32, xrefs: 00116E58, 00116EDD
0, xrefs: 00116D98

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: e5272f5c4b882257727ad17972dc80d900a753a1525618eb67002a946044abc0
Instruction ID: cd478484915ac3aa94323b73886509651c45dab32e3c5bedceccf461027142b7
Opcode Fuzzy Hash: e5272f5c4b882257727ad17972dc80d900a753a1525618eb67002a946044abc0
Instruction Fuzzy Hash: 58717670244341AFDB29CF18D858BEABBE9FB89304F04452DF99987261C772A986CB51

Function 0011911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00099BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00099BB2

DragQueryPoint.SHELL32(?,?), ref: 00119147

Part of subcall function 00117674: ClientToScreen.USER32(?,?), ref: 0011769A
Part of subcall function 00117674: GetWindowRect.USER32(?,?), ref: 00117710
Part of subcall function 00117674: PtInRect.USER32(?,?,00118B89), ref: 00117720

SendMessageW.USER32(?,000000B0,?,?), ref: 001191B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 001191BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 001191DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00119225
SendMessageW.USER32(?,000000B0,?,?), ref: 0011923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00119255
SendMessageW.USER32(?,000000B1,?,?), ref: 00119277
DragFinish.SHELL32(?), ref: 0011927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00119371

Strings

@GUI_DRAGID, xrefs: 001192E9
@GUI_DRAGFILE, xrefs: 00119320
@GUI_DROPID, xrefs: 0011929E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 5b202432e82a8870a29655a1ff5d319c2dc5fe8bc2a4612d250554e4ea490989
Instruction ID: 1fbf136a1db9306a7e595fc5bee74c640a2ebc0afa00fc9fc1ca146e2ac1b6cc
Opcode Fuzzy Hash: 5b202432e82a8870a29655a1ff5d319c2dc5fe8bc2a4612d250554e4ea490989
Instruction Fuzzy Hash: 96615771108301AFD705EF64D985DEFBBE8FF89750F00092EF5A5961A1DB309A89CB92

Function 000FC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 000FC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 000FC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 000FC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 000FC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 000FC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 000FC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000FC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 000FC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 000FC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 000FC5F0
InternetCloseHandle.WININET(00000000), ref: 000FC5FB

Strings

, xrefs: 000FC575

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 297f0f6a1b0860573160bfa54579794688fa9bb473ccd436f1bfeccc73f890c1
Instruction ID: 02c522bb4ba66c95b1ff573af5ed310c3143084fce38024a3ed6288d32a0588c
Opcode Fuzzy Hash: 297f0f6a1b0860573160bfa54579794688fa9bb473ccd436f1bfeccc73f890c1
Instruction Fuzzy Hash: 1E516EB054060CBFEB258F64CA49EBB7BFCFB04754F008419FA4696A50D770E984EBA0

Function 0011856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00118592
GetFileSize.KERNEL32(00000000,00000000), ref: 001185A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 001185AD
CloseHandle.KERNEL32(00000000), ref: 001185BA
GlobalLock.KERNEL32(00000000), ref: 001185C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 001185D7
GlobalUnlock.KERNEL32(00000000), ref: 001185E0
CloseHandle.KERNEL32(00000000), ref: 001185E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 001185F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0011FC38,?), ref: 00118611
GlobalFree.KERNEL32(00000000), ref: 00118621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00118641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00118671
DeleteObject.GDI32(00000000), ref: 00118699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 001186AF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: d3aa18ce4b78c79f7496ad0145de389bb1d43c4d000289fed23d23a2745fc0d9
Instruction ID: 885da14b6931242f4e6d80afd3c853cb672cf7a77678d6b29a5189138ba8a01c
Opcode Fuzzy Hash: d3aa18ce4b78c79f7496ad0145de389bb1d43c4d000289fed23d23a2745fc0d9
Instruction Fuzzy Hash: 2E412975640204BFDB199FA5CD48EEA7BBDFF89711F108168F905E7260DB309981CB60

Function 000F14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 000F1502
VariantCopy.OLEAUT32(?,?), ref: 000F150B
VariantClear.OLEAUT32(?), ref: 000F1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 000F15FB
VarR8FromDec.OLEAUT32(?,?), ref: 000F1657
VariantInit.OLEAUT32(?), ref: 000F1708
SysFreeString.OLEAUT32(?), ref: 000F178C
VariantClear.OLEAUT32(?), ref: 000F17D8
VariantClear.OLEAUT32(?), ref: 000F17E7
VariantInit.OLEAUT32(00000000), ref: 000F1823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 000F1625
Default, xrefs: 000F16AF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: fec36850c81b36255f19e6282f86a2ea71a9d1c9ac89e95269cc42337cf6394d
Instruction ID: 4bf9ea734b4c3e4fa5a40c878a792fddd44bed781165714bcd67890388be3f20
Opcode Fuzzy Hash: fec36850c81b36255f19e6282f86a2ea71a9d1c9ac89e95269cc42337cf6394d
Instruction Fuzzy Hash: 7FD12231A04A19DBDF14AF64D885BFDB7B6BF45B00F108056F656AB981DB30DC40EBA1

Function 0010B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 0010C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0010B6AE,?,?), ref: 0010C9B5
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010C9F1
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010CA68
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0010B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0010B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0010B80A
RegCloseKey.ADVAPI32(?), ref: 0010B87E
RegCloseKey.ADVAPI32(?), ref: 0010B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0010B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0010B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0010B922
FreeLibrary.KERNEL32(00000000), ref: 0010B983
RegCloseKey.ADVAPI32(00000000), ref: 0010B994

Strings

RegDeleteKeyExW, xrefs: 0010B8FE
advapi32.dll, xrefs: 0010B8ED

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: d78a3ceb04ee2e22d4029fa2a6ba02e52ea6d7c6f1d7e3c2d229ec44cacc8b19
Instruction ID: 9fd898a29c40174a43ded377f0e4bf18c0d638a582b66d27333860c957a7cfc6
Opcode Fuzzy Hash: d78a3ceb04ee2e22d4029fa2a6ba02e52ea6d7c6f1d7e3c2d229ec44cacc8b19
Instruction Fuzzy Hash: 7CC17A74208201EFD714EF24C495F6ABBE5BF84308F14859CF59A8B6A2CBB1ED45CB91

Function 0010255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 001025D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 001025E8
CreateCompatibleDC.GDI32(?), ref: 001025F4
SelectObject.GDI32(00000000,?), ref: 00102601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0010266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 001026AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 001026D0
SelectObject.GDI32(?,?), ref: 001026D8
DeleteObject.GDI32(?), ref: 001026E1
DeleteDC.GDI32(?), ref: 001026E8
ReleaseDC.USER32(00000000,?), ref: 001026F3

Strings

(, xrefs: 0010268D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: a2824fe13c327fecb81f3854d0fe0162b7dd694a569d91d743a2c14a45152c52
Instruction ID: 132fe82fea11367cef6e806a9ca52f43ccec356d8268561cb62fbc211205c99a
Opcode Fuzzy Hash: a2824fe13c327fecb81f3854d0fe0162b7dd694a569d91d743a2c14a45152c52
Instruction Fuzzy Hash: EE61E2B5D00219EFCF08CFA4D988AEEBBB6FF48310F208529E955A7250D771A941CF90

Function 000BDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 000BDAA1

Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD659
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD66B
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD67D
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD68F
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD6A1
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD6B3
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD6C5
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD6D7
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD6E9
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD6FB
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD70D
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD71F
Part of subcall function 000BD63C: _free.LIBCMT ref: 000BD731

_free.LIBCMT ref: 000BDA96

Part of subcall function 000B29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000), ref: 000B29DE
Part of subcall function 000B29C8: GetLastError.KERNEL32(00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000,00000000), ref: 000B29F0

_free.LIBCMT ref: 000BDAB8
_free.LIBCMT ref: 000BDACD
_free.LIBCMT ref: 000BDAD8
_free.LIBCMT ref: 000BDAFA
_free.LIBCMT ref: 000BDB0D
_free.LIBCMT ref: 000BDB1B
_free.LIBCMT ref: 000BDB26
_free.LIBCMT ref: 000BDB5E
_free.LIBCMT ref: 000BDB65
_free.LIBCMT ref: 000BDB82
_free.LIBCMT ref: 000BDB9A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b5edca430f13057343ba2380922492ad095432592e070475de0506f8bd19b70c
Instruction ID: 884629f53a6d54f442bd8cf855baa792f400c9e28d5a23ed99b510c69163fe10
Opcode Fuzzy Hash: b5edca430f13057343ba2380922492ad095432592e070475de0506f8bd19b70c
Instruction Fuzzy Hash: 1E312831604605EFEB61AA39E845BDAF7E9FF00320F15482AE449D7192EF31EC80CB25

Function 000E365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 000E369C
_wcslen.LIBCMT ref: 000E36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 000E3797
GetClassNameW.USER32(?,?,00000400), ref: 000E380C
GetDlgCtrlID.USER32(?), ref: 000E385D
GetWindowRect.USER32(?,?), ref: 000E3882
GetParent.USER32(?), ref: 000E38A0
ScreenToClient.USER32(00000000), ref: 000E38A7
GetClassNameW.USER32(?,?,00000100), ref: 000E3921
GetWindowTextW.USER32(?,?,00000400), ref: 000E395D

Strings

%s%u, xrefs: 000E3734

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 2d44c70127435b7eee400b1e78e47b8f84296ea1c8de86b0a1f81baeef646974
Instruction ID: 73d8166e1498624a91474466d7f0afc6593ae2498966b6ca6f03dc02adfdfb7d
Opcode Fuzzy Hash: 2d44c70127435b7eee400b1e78e47b8f84296ea1c8de86b0a1f81baeef646974
Instruction Fuzzy Hash: C2919E71204746AFD718DF66C889BEAFBE8FF44350F008529F999A3191DB30AA45CB91

Function 000E4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 000E4994
GetWindowTextW.USER32(?,?,00000400), ref: 000E49DA
_wcslen.LIBCMT ref: 000E49EB
CharUpperBuffW.USER32(?,00000000), ref: 000E49F7
_wcsstr.LIBVCRUNTIME ref: 000E4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 000E4A64
GetWindowTextW.USER32(?,?,00000400), ref: 000E4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 000E4AE6
GetClassNameW.USER32(?,?,00000400), ref: 000E4B20
GetWindowRect.USER32(?,?), ref: 000E4B8B

Strings

ThumbnailClass, xrefs: 000E4A6F, 000E4AF1

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: dc3da5dafe81c0c33c33244c06c83adfc6f426423409f5552f1396da48fba706
Instruction ID: 86e96af3b2f583b1c491215d3b7a521656b1f97bb69a9624af7df6f35a41f60f
Opcode Fuzzy Hash: dc3da5dafe81c0c33c33244c06c83adfc6f426423409f5552f1396da48fba706
Instruction Fuzzy Hash: B391DF710043459FDB08DF16C985FAA77E8FF84314F08846AFD85AA196EB34ED45CBA2

Function 000EBF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00151990,000000FF,00000000,00000030), ref: 000EBFAC
SetMenuItemInfoW.USER32(00151990,00000004,00000000,00000030), ref: 000EBFE1
Sleep.KERNEL32(000001F4), ref: 000EBFF3
GetMenuItemCount.USER32(?), ref: 000EC039
GetMenuItemID.USER32(?,00000000), ref: 000EC056
GetMenuItemID.USER32(?,-00000001), ref: 000EC082
GetMenuItemID.USER32(?,?), ref: 000EC0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 000EC10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000EC124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000EC145

Strings

0, xrefs: 000EBF3D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 69472eb3f8cf1de65dc2ba756970822da434f94a4a5e49411a86bddf6d499cb4
Instruction ID: ed2613198d4966418e6fc67d16e671ebc505967e74e6e5d04491885035d1d24f
Opcode Fuzzy Hash: 69472eb3f8cf1de65dc2ba756970822da434f94a4a5e49411a86bddf6d499cb4
Instruction Fuzzy Hash: 6A617F70A00385AFEF65CF65DD88EEE7BB9EB45344F044055E811B3292C732AD46CBA0

Function 0010CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0010CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0010CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0010CD48

Part of subcall function 0010CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0010CCAA
Part of subcall function 0010CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0010CCBD
Part of subcall function 0010CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0010CCCF
Part of subcall function 0010CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0010CD05
Part of subcall function 0010CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0010CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0010CCF3

Strings

RegDeleteKeyExW, xrefs: 0010CCC9
advapi32.dll, xrefs: 0010CCB8

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 06a5c96b2217e3aca96a6c23ff3eea84d64c70fab03fa934a1ed757d74ff4cb6
Instruction ID: dff70d23d94a2d5a1b5ce2b06b554497fa92dbc0e4260f672fced8cbf6009b42
Opcode Fuzzy Hash: 06a5c96b2217e3aca96a6c23ff3eea84d64c70fab03fa934a1ed757d74ff4cb6
Instruction Fuzzy Hash: 0E31AE71941129BBDB248B90DD88EFFBB7CEF45740F004265B945E2290DB708E859BE0

Function 000F3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 000F3D40
_wcslen.LIBCMT ref: 000F3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 000F3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 000F3DBE
RemoveDirectoryW.KERNEL32(?), ref: 000F3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 000F3E55
CloseHandle.KERNEL32(00000000), ref: 000F3E60
CloseHandle.KERNEL32(00000000), ref: 000F3E6B

Strings

:, xrefs: 000F3D82
\, xrefs: 000F3D77
\??\%s, xrefs: 000F3D5B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 608569ce430b1c96bef99f1d2f49e54ec6d2433ac4f7e592aaa933047cf0f508
Instruction ID: 67b198c23c8ee0886c893fca5fdbab502e879f85d43a728a8f9f8b8e826233d5
Opcode Fuzzy Hash: 608569ce430b1c96bef99f1d2f49e54ec6d2433ac4f7e592aaa933047cf0f508
Instruction Fuzzy Hash: 0531D072940219ABDB209FA0DC49FEF37BDEF89750F1040B5F609D2461EB7097848B64

Function 000EE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000EE6B4

Part of subcall function 0009E551: timeGetTime.WINMM(?,?,000EE6D4), ref: 0009E555

Sleep.KERNEL32(0000000A), ref: 000EE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 000EE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 000EE727
SetActiveWindow.USER32 ref: 000EE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 000EE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 000EE773
Sleep.KERNEL32(000000FA), ref: 000EE77E
IsWindow.USER32 ref: 000EE78A
EndDialog.USER32(00000000), ref: 000EE79B

Strings

BUTTON, xrefs: 000EE719

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: a538359f5d68b860ebe2f137fb043691e2f00e68da96b9937ea79088c565d8c4
Instruction ID: 11203651bfb37206ecd6d2f814a87df7e7189a84c1baed9b699cb793288ae66f
Opcode Fuzzy Hash: a538359f5d68b860ebe2f137fb043691e2f00e68da96b9937ea79088c565d8c4
Instruction Fuzzy Hash: B121F6712403C9FFEB005F21ED89B693BAAF75534AF104424F805A6AB1DB719C80CA54

Function 000EE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 000EEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 000EEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000EEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 000EEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 000EEAA7

Strings

open , xrefs: 000EEA0C
status PlayMe mode, xrefs: 000EEA58
play PlayMe wait, xrefs: 000EEA91
close PlayMe, xrefs: 000EEA6E, 000EEA9B
play PlayMe, xrefs: 000EEAA2
alias PlayMe, xrefs: 000EEA36

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: c951f403eb900da9d7734d1af0359668200b529546b3f056547a723ad26873d6
Instruction ID: 3ab5d6ab87f3bb9e8fd71c9fecb07829e51888ca7c9d3a1aa4ac33530db12671
Opcode Fuzzy Hash: c951f403eb900da9d7734d1af0359668200b529546b3f056547a723ad26873d6
Instruction Fuzzy Hash: 311154316502997DD720B762DC4ADFF6ABCFBD2B18F440439B441A20E1EFB01A45C6B2

Function 000E9F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 000EA012
SetKeyboardState.USER32(?), ref: 000EA07D
GetAsyncKeyState.USER32(000000A0), ref: 000EA09D
GetKeyState.USER32(000000A0), ref: 000EA0B4
GetAsyncKeyState.USER32(000000A1), ref: 000EA0E3
GetKeyState.USER32(000000A1), ref: 000EA0F4
GetAsyncKeyState.USER32(00000011), ref: 000EA120
GetKeyState.USER32(00000011), ref: 000EA12E
GetAsyncKeyState.USER32(00000012), ref: 000EA157
GetKeyState.USER32(00000012), ref: 000EA165
GetAsyncKeyState.USER32(0000005B), ref: 000EA18E
GetKeyState.USER32(0000005B), ref: 000EA19C

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c729a0458a2b025e272bf194c9b4524c55afa14dbbfa1fea724a8c28ba2bd958
Instruction ID: 94ff92b9c3de42536a52d42067fd897462631e86b93646517541232f6eeb1420
Opcode Fuzzy Hash: c729a0458a2b025e272bf194c9b4524c55afa14dbbfa1fea724a8c28ba2bd958
Instruction Fuzzy Hash: 3551A520A047C82DFB75DBA288117EABFF59F16380F088599D5C2661C3DA54BA8CC762

Function 000E5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 000E5CE2
GetWindowRect.USER32(00000000,?), ref: 000E5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 000E5D59
GetDlgItem.USER32(?,00000002), ref: 000E5D69
GetWindowRect.USER32(00000000,?), ref: 000E5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 000E5DCF
GetDlgItem.USER32(?,000003E9), ref: 000E5DDD
GetWindowRect.USER32(00000000,?), ref: 000E5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 000E5E31
GetDlgItem.USER32(?,000003EA), ref: 000E5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 000E5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 000E5E67

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 2a76609f1b5fde693362d8452cd8d80e422f29a4db2414a23a67f844b3dce6ec
Instruction ID: b2adb2cf596ad9c22ad5c327eac706c6522970354eca6d6a8e522c33badf7e59
Opcode Fuzzy Hash: 2a76609f1b5fde693362d8452cd8d80e422f29a4db2414a23a67f844b3dce6ec
Instruction Fuzzy Hash: 8D512D70A40605AFDB18CF69CE89AAEBBF5FB48305F108529F515E7690D7709E40CB90

Function 00098BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00098F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00098BE8,?,00000000,?,?,?,?,00098BBA,00000000,?), ref: 00098FC5

DestroyWindow.USER32(?), ref: 00098C81
KillTimer.USER32(00000000,?,?,?,?,00098BBA,00000000,?), ref: 00098D1B
DestroyAcceleratorTable.USER32(00000000), ref: 000D6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00098BBA,00000000,?), ref: 000D69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00098BBA,00000000,?), ref: 000D69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00098BBA,00000000), ref: 000D69D4
DeleteObject.GDI32(00000000), ref: 000D69E6

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 98eafee910fedb6295ccfbcdba9f219a29a6eb6a8571f0bd4315fa2943d62b90
Instruction ID: f985b1984c7d317278e3fb98688bbd27da181b2bf626fa1ed82b84f3aef0e185
Opcode Fuzzy Hash: 98eafee910fedb6295ccfbcdba9f219a29a6eb6a8571f0bd4315fa2943d62b90
Instruction Fuzzy Hash: FB615B70502700EFCF769F14DA58B69B7F1FB45316F14851DE0429AA60CB72A9C0EFA1

Function 00099838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00099944: GetWindowLongW.USER32(?,000000EB), ref: 00099952

GetSysColor.USER32(0000000F), ref: 00099862

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 23a503fde5270c85e393e4b1a85d8b654588d3825197ab428427714857cb8a01
Instruction ID: e745cd6399ed400301e99e219722f3c87235c159feb75ac0380c95277358a87c
Opcode Fuzzy Hash: 23a503fde5270c85e393e4b1a85d8b654588d3825197ab428427714857cb8a01
Instruction Fuzzy Hash: 4B418131144640EFDF245F3C9C84BBA3BA5AB46331F14461DF9A6872E1EB719C81EB61

Function 000B8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

., xrefs: 000B903A, 000B8FD0, 000B8FF2

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-1232320464
Opcode ID: 65fe5247346b6f68ac69624201867ef671cb9d69b0d8d91a6fd0c28ae57f7e03
Instruction ID: bccbfa83ba910b797bc3f2613f1237d54833f5abb7ef5fda3c4497db58b2f1a8
Opcode Fuzzy Hash: 65fe5247346b6f68ac69624201867ef671cb9d69b0d8d91a6fd0c28ae57f7e03
Instruction Fuzzy Hash: 14C1C274904349AFDB61EFE8D845BFDBBF4AF09310F148199E915AB392CB309941CB61

Function 000E96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,000CF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 000E9717
LoadStringW.USER32(00000000,?,000CF7F8,00000001), ref: 000E9720

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,000CF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 000E9742
LoadStringW.USER32(00000000,?,000CF7F8,00000001), ref: 000E9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 000E9866

Strings

Line %d (File "%s"):, xrefs: 000E978F
^ ERROR, xrefs: 000E97FB
Line %d:, xrefs: 000E97A0
%s (%d) : ==> %s: %s %s, xrefs: 000E984A
Error: , xrefs: 000E981D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 5b0dd6763f04f0658c19273026b5f5872bd111780d2584e560bd74a9bc19326c
Instruction ID: 4e494416b4942397d86e9b1323065caaa5cfdb53c648486cca47217c15c6556d
Opcode Fuzzy Hash: 5b0dd6763f04f0658c19273026b5f5872bd111780d2584e560bd74a9bc19326c
Instruction Fuzzy Hash: 33411972900219AACF04FBE0CE86EEEB778AF55740F540065F645720A3EB356F49CBA1

Function 000E06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00086B57: _wcslen.LIBCMT ref: 00086B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 000E07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 000E07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 000E07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 000E0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 000E082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 000E0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 000E083C

Strings

\IPC$, xrefs: 000E0784
\CLSID, xrefs: 000E0724
SOFTWARE\Classes\, xrefs: 000E070E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: d236a91b7d11bea7027ea9f9663806956ce553344742bfb4456550e2923c539b
Instruction ID: fd461b05e57dc815805dcf50d7c61121f9e30f34b5360f62af91491b8882a3c5
Opcode Fuzzy Hash: d236a91b7d11bea7027ea9f9663806956ce553344742bfb4456550e2923c539b
Instruction Fuzzy Hash: C2411572D10229AFDF15EBA4DC858EDB7B8BF54750B044129E941B3162EB709E44CBA0

Function 00113F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0011403B
CreateCompatibleDC.GDI32(00000000), ref: 00114042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00114055
SelectObject.GDI32(00000000,00000000), ref: 0011405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00114068
DeleteDC.GDI32(00000000), ref: 00114072
GetWindowLongW.USER32(?,000000EC), ref: 0011407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00114092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 0011409E

Strings

static, xrefs: 00113FD3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: e6de91bca881fef713db8f14bf97566b3e4a27b348cc10bfa8b1fe1605c1b9eb
Instruction ID: 48f25b297fcd946d740eca51ae50fadd1b0109ed65a3d09cc811836318bf9747
Opcode Fuzzy Hash: e6de91bca881fef713db8f14bf97566b3e4a27b348cc10bfa8b1fe1605c1b9eb
Instruction Fuzzy Hash: 99317A32140215BBDF269FA4DC08FDA3B69FF0D720F114220FA18A61A0C775D8A1DB94

Function 00103C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00103C5C
CoInitialize.OLE32(00000000), ref: 00103C8A
CoUninitialize.OLE32 ref: 00103C94
_wcslen.LIBCMT ref: 00103D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00103DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00103ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00103F0E
CoGetObject.OLE32(?,00000000,0011FB98,?), ref: 00103F2D
SetErrorMode.KERNEL32(00000000), ref: 00103F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00103FC4
VariantClear.OLEAUT32(?), ref: 00103FD8

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 988b151f41c3fcd41369f3d4438cd8eeb72e826d859c14197c162fcfdb87983b
Instruction ID: 71a1bbeb04f90adc4635586993841fdf351417ceb727ab3dc52da51954003d8c
Opcode Fuzzy Hash: 988b151f41c3fcd41369f3d4438cd8eeb72e826d859c14197c162fcfdb87983b
Instruction Fuzzy Hash: 84C177716083019FC704DF68C98496BB7E9FF89744F00491DF99A9B291D770EE46CB92

Function 000F7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 000F7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 000F7B8F
SHGetDesktopFolder.SHELL32(?), ref: 000F7BA3
CoCreateInstance.OLE32(0011FD08,00000000,00000001,00146E6C,?), ref: 000F7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 000F7C74
CoTaskMemFree.OLE32(?,?), ref: 000F7CCC
SHBrowseForFolderW.SHELL32(?), ref: 000F7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 000F7D7A
CoTaskMemFree.OLE32(00000000), ref: 000F7D81
CoTaskMemFree.OLE32(00000000), ref: 000F7DD6
CoUninitialize.OLE32 ref: 000F7DDC

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 464da0d8dabec2dcfb98ba1153611b3da62c2a4e5a72b998e2c9980efe3e1fb9
Instruction ID: 3c65e065be0275bc2989d9968edba9e6a8fed908872e17a75d07464664eda181
Opcode Fuzzy Hash: 464da0d8dabec2dcfb98ba1153611b3da62c2a4e5a72b998e2c9980efe3e1fb9
Instruction Fuzzy Hash: 9FC12C75A04109AFCB14DFA4C884DAEBBF9FF49304B148499E919DB762D731EE41CB90

Function 0011541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00115504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00115515
CharNextW.USER32(00000158), ref: 00115544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00115585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0011559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001155AC

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 9e56aa7fa2e94a1ba441c7768f182c04865846d4944093789cb7c90245414627
Instruction ID: 583326cb8923ca9fddc221e9a3362c50d4bda20f135c0b73867c836d04d08aeb
Opcode Fuzzy Hash: 9e56aa7fa2e94a1ba441c7768f182c04865846d4944093789cb7c90245414627
Instruction Fuzzy Hash: 19619230900608EFDF189F54CD849FE7BBAEB49725F108165F525AB691E7708AC0DBA1

Function 000DFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 000DFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 000DFB08
VariantInit.OLEAUT32(?), ref: 000DFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 000DFB3A
VariantCopy.OLEAUT32(?,?), ref: 000DFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 000DFBA1
VariantClear.OLEAUT32(?), ref: 000DFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 000DFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 000DFBCC
VariantClear.OLEAUT32(?), ref: 000DFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 000DFBE9

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 815171271f31a6271f5c153650327f05ac64d9a8a2040ec7e8eda75106dde9cc
Instruction ID: b6a96130a44ca0081583d616164517231dad5052447a3e27a991d0f5429aaaf6
Opcode Fuzzy Hash: 815171271f31a6271f5c153650327f05ac64d9a8a2040ec7e8eda75106dde9cc
Instruction Fuzzy Hash: 53416F35A0421A9FDB04DFA8D8549FEBBB9FF08354F00C06AF946A7761C730A945CBA0

Function 000E9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 000E9CA1
GetAsyncKeyState.USER32(000000A0), ref: 000E9D22
GetKeyState.USER32(000000A0), ref: 000E9D3D
GetAsyncKeyState.USER32(000000A1), ref: 000E9D57
GetKeyState.USER32(000000A1), ref: 000E9D6C
GetAsyncKeyState.USER32(00000011), ref: 000E9D84
GetKeyState.USER32(00000011), ref: 000E9D96
GetAsyncKeyState.USER32(00000012), ref: 000E9DAE
GetKeyState.USER32(00000012), ref: 000E9DC0
GetAsyncKeyState.USER32(0000005B), ref: 000E9DD8
GetKeyState.USER32(0000005B), ref: 000E9DEA

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 056198ea45e518c1ca89f38a71845be72f69e82f3683f513dcb0c2e32c175beb
Instruction ID: 57a35c3a01483a9036357490312f119b7a97b11f66343e8fab2d238406f079b9
Opcode Fuzzy Hash: 056198ea45e518c1ca89f38a71845be72f69e82f3683f513dcb0c2e32c175beb
Instruction Fuzzy Hash: 5641F8346087DA6DFFB4976288043F5FEE16F11344F08805ADAC6766C2DBE499C8C7A2

Function 0010055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 001005BC
inet_addr.WSOCK32(?), ref: 0010061C
gethostbyname.WSOCK32(?), ref: 00100628
IcmpCreateFile.IPHLPAPI ref: 00100636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 001006C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 001006E5
IcmpCloseHandle.IPHLPAPI(?), ref: 001007B9
WSACleanup.WSOCK32 ref: 001007BF

Strings

Ping, xrefs: 00100676

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 20317136a392aa2bb35385774410751fcc5d7d636ba9c59522a4a136036b69b1
Instruction ID: 908fcf105debb7385e5b02879919ec1e2e156e63ac218913e7ffd2ffd2433812
Opcode Fuzzy Hash: 20317136a392aa2bb35385774410751fcc5d7d636ba9c59522a4a136036b69b1
Instruction Fuzzy Hash: 6091BF34608201AFD725DF15C888F1ABBE0BF49318F1585A9F4E98B6A2C7B4ED41CF91

Function 00108CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00108CF3

Part of subcall function 000E8E54: _wcslen.LIBCMT ref: 000E8E77

_wcslen.LIBCMT ref: 00108D4E
_wcslen.LIBCMT ref: 00108D9C
_wcslen.LIBCMT ref: 00108DDC
_wcslen.LIBCMT ref: 00108E6E

Strings

none, xrefs: 00108E65, 00108E6A
cdecl, xrefs: 00108D48, 00108D4D
winapi, xrefs: 00108D96, 00108D9B
stdcall, xrefs: 00108DD6, 00108DDB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: f7d7216305e8617239c55748574b9fbe38a4acad0bf4ea0449f6cd695b89aae0
Instruction ID: 4ad3c6c6f7dca10f65358839ef633f591c37cf7bd590f7c1a149ea8d41b21c57
Opcode Fuzzy Hash: f7d7216305e8617239c55748574b9fbe38a4acad0bf4ea0449f6cd695b89aae0
Instruction Fuzzy Hash: B151A031A085169BCF14EFA8C9408BEB7A6BF65324B214229E4E6E72C1DBB0DD40C790

Function 0010372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00103774
CoUninitialize.OLE32 ref: 0010377F
CoCreateInstance.OLE32(?,00000000,00000017,0011FB78,?), ref: 001037D9
IIDFromString.OLE32(?,?), ref: 0010384C
VariantInit.OLEAUT32(?), ref: 001038E4
VariantClear.OLEAUT32(?), ref: 00103936

Strings

Invalid parameter, xrefs: 00103865
Failed to create object, xrefs: 001037E4, 0010389A
NULL Pointer assignment, xrefs: 0010381E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: ecdf001291f28df9124cb1016291d0cee61124051d6d84cb4d1e596bca6b3d67
Instruction ID: cee8a99d17d0f059bfa25e5a6a48d8d90e4250173e6d6042fec91473aeb39f5e
Opcode Fuzzy Hash: ecdf001291f28df9124cb1016291d0cee61124051d6d84cb4d1e596bca6b3d67
Instruction Fuzzy Hash: 6C61A070608701AFD315DF54C888FAAB7E8EF49714F10495AF5D59B291C7B0EE48CB92

Function 000F3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 000F33CF

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 000F33F0

Strings

Line %d (File "%s"):, xrefs: 000F3443, 000F345C
^ ERROR , xrefs: 000F349E
"%s" (%d) : ==> %s:, xrefs: 000F3522
"%s" (%d) : ==> %s:%s%s, xrefs: 000F3504
Incorrect parameters to object property !, xrefs: 000F34AB
Error: , xrefs: 000F34D1

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 6c6aca7cef982f14c1ae75ab17cdb60dc3d3a4249a0a3f34d8d43082c6513077
Instruction ID: 2bae7c88a797850b77685aa08319c9503beb4cefcfb56419a35f144e7cb0f9b0
Opcode Fuzzy Hash: 6c6aca7cef982f14c1ae75ab17cdb60dc3d3a4249a0a3f34d8d43082c6513077
Instruction Fuzzy Hash: D251887290020AAADF15FBA0CD46EFEB3B8BF14750F244065F505720A2EB252F98DB61

Function 000EB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 000EB5FC
_wcslen.LIBCMT ref: 000EB608
_wcslen.LIBCMT ref: 000EB64D
_wcslen.LIBCMT ref: 000EB68C
_wcslen.LIBCMT ref: 000EB6C7

Strings

EXISTS, xrefs: 000EB686, 000EB68B
APPEND, xrefs: 000EB6C1, 000EB6C6
KEYS, xrefs: 000EB647, 000EB64C
REMOVE, xrefs: 000EB602, 000EB607

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 6d53962ca0ca93027efe864eebf950c7a1a19651e1f91a586567dd4913016eda
Instruction ID: f6d0bc16a5abc4eaa233111b31cf5b8b703b8981cac5abfcd8de481b8919b525
Opcode Fuzzy Hash: 6d53962ca0ca93027efe864eebf950c7a1a19651e1f91a586567dd4913016eda
Instruction Fuzzy Hash: CD410832A000679ECB606F7E89905BFB7E5BFA1754B254129E461F7284E739CD81C790

Function 000F5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000F53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 000F5416
GetLastError.KERNEL32 ref: 000F5420
SetErrorMode.KERNEL32(00000000,READY), ref: 000F54A7

Strings

UNKNOWN, xrefs: 000F5444
READONLY, xrefs: 000F5452
NOTREADY, xrefs: 000F544B
READY, xrefs: 000F5460, 000F5468
INVALID, xrefs: 000F5459

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: a987cd8e79de791b7c4751b6cc55a6b14493e886f58ea3655fe34b8e19935191
Instruction ID: e9513524b15c5fcc0be446b2fec18169ab5c036528734c1938a41c861309998a
Opcode Fuzzy Hash: a987cd8e79de791b7c4751b6cc55a6b14493e886f58ea3655fe34b8e19935191
Instruction Fuzzy Hash: 1F31C235A006089FC710DF68C984AFABBF4FF0530AF148069E605DB662D730ED82DBA1

Function 00113C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00113C79
SetMenu.USER32(?,00000000), ref: 00113C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00113D10
IsMenu.USER32(?), ref: 00113D24
CreatePopupMenu.USER32 ref: 00113D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00113D5B
DrawMenuBar.USER32 ref: 00113D63

Strings

0, xrefs: 00113C54
F, xrefs: 00113D4E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 39735f68c82f4556a89efbae1b9fa109cbe9963928b679c130bbd38c1747fc3d
Instruction ID: 5b4bc86ed256d60ccfbaccb791f3e432c0f98d91282e23d125fc37cb289aa68f
Opcode Fuzzy Hash: 39735f68c82f4556a89efbae1b9fa109cbe9963928b679c130bbd38c1747fc3d
Instruction Fuzzy Hash: E6418879A01609EFDF18CFA4E844BEA7BB6FF49314F144029E956A7360D730AA50CF90

Function 000E1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 000E3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 000E3CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 000E1F64
GetDlgCtrlID.USER32 ref: 000E1F6F
GetParent.USER32 ref: 000E1F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 000E1F8E
GetDlgCtrlID.USER32(?), ref: 000E1F97
GetParent.USER32(?), ref: 000E1FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 000E1FAE

Strings

ListBox, xrefs: 000E1F21
ComboBox, xrefs: 000E1EEC

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: be8a6dfdcc9ee10fd5d35c1befd8f3664827cb26bc4e39c2e69a3e54eb867970
Instruction ID: 0b743ffd7e3f4e977dc9fc9290f56bcc7d22f0aaf0acc872ca5cbca34f3b7177
Opcode Fuzzy Hash: be8a6dfdcc9ee10fd5d35c1befd8f3664827cb26bc4e39c2e69a3e54eb867970
Instruction Fuzzy Hash: 1421CF70940218BFCF04AFA1CC85DFEBBB9EF05350B104125F961A72A2DB359948DBA0

Function 000E1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 000E3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 000E3CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 000E2043
GetDlgCtrlID.USER32 ref: 000E204E
GetParent.USER32 ref: 000E206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 000E206D
GetDlgCtrlID.USER32(?), ref: 000E2076
GetParent.USER32(?), ref: 000E208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 000E208D

Strings

ListBox, xrefs: 000E2002
ComboBox, xrefs: 000E1FCD

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 5ef093c27337c158505e62c23fc810c6d4187248c1faca509dec677b18e1327a
Instruction ID: 5631ade3842a0f595e48c9ad820a9a1ac0859048571ce4fbb3dfd3d3347e17c2
Opcode Fuzzy Hash: 5ef093c27337c158505e62c23fc810c6d4187248c1faca509dec677b18e1327a
Instruction Fuzzy Hash: 9A21D1B1940218BFCF15AFA0CC85EFEBBB8FF09340F104015B991A72A2DB758954DB60

Function 00113A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00113A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00113AA0
GetWindowLongW.USER32(?,000000F0), ref: 00113AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00113AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00113B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00113BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00113BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00113BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00113BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00113C13

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 13ae93ac6af49ecf557495c1fd21206ddffc43d7944127833cce79b795912bcf
Instruction ID: 66c4dda7db6cfd061279488b6b13cf53bb272032d716dfd7916449c81e495edd
Opcode Fuzzy Hash: 13ae93ac6af49ecf557495c1fd21206ddffc43d7944127833cce79b795912bcf
Instruction Fuzzy Hash: 96618D75900208EFDB15DF68CC81FEE77B8EB09714F10406AFA25AB291D770AE85DB50

Function 000EB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000EB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,000EA1E1,?,00000001), ref: 000EB165
GetWindowThreadProcessId.USER32(00000000), ref: 000EB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,000EA1E1,?,00000001), ref: 000EB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 000EB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,000EA1E1,?,00000001), ref: 000EB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,000EA1E1,?,00000001), ref: 000EB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,000EA1E1,?,00000001), ref: 000EB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,000EA1E1,?,00000001), ref: 000EB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,000EA1E1,?,00000001), ref: 000EB21D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: fd768d624e719a3a9d3ba74780b9388c418ff2e7db4775b7c3c451d9112771d1
Instruction ID: 02c2c44c8ebadf919e20a02976bbc00584e0d75542ba4db9dae1ab7dc5ec78de
Opcode Fuzzy Hash: fd768d624e719a3a9d3ba74780b9388c418ff2e7db4775b7c3c451d9112771d1
Instruction Fuzzy Hash: FC31AC75540344FFDB549F29DD48BAFBBA9AF50352F508008FA10EB690E7B49A808FA4

Function 000B2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000B2C94

Part of subcall function 000B29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000), ref: 000B29DE
Part of subcall function 000B29C8: GetLastError.KERNEL32(00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000,00000000), ref: 000B29F0

_free.LIBCMT ref: 000B2CA0
_free.LIBCMT ref: 000B2CAB
_free.LIBCMT ref: 000B2CB6
_free.LIBCMT ref: 000B2CC1
_free.LIBCMT ref: 000B2CCC
_free.LIBCMT ref: 000B2CD7
_free.LIBCMT ref: 000B2CE2
_free.LIBCMT ref: 000B2CED
_free.LIBCMT ref: 000B2CFB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1eca75c6f2ce99b01a3634ffd75e3259ce6f5a7bbbc2c2e0700cc84d03dffc86
Instruction ID: f37f302756c869b9397a613cbcf1ac924093b81981a89ad4e3bcc11f952d775e
Opcode Fuzzy Hash: 1eca75c6f2ce99b01a3634ffd75e3259ce6f5a7bbbc2c2e0700cc84d03dffc86
Instruction Fuzzy Hash: 94114276510108BFCB02EF94D982CDD3BA9FF09350F9149A5FA489F223DA31EE509B90

Function 00081410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00081459
OleUninitialize.OLE32(?,00000000), ref: 000814F8
UnregisterHotKey.USER32(?), ref: 000816DD
DestroyWindow.USER32(?), ref: 000C24B9
FreeLibrary.KERNEL32(?), ref: 000C251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 000C254B

Strings

close all, xrefs: 00081454

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 9a49b9f920199c15ecf1e2b0faad554f7ff7196835fa6b5a59d5ec414b3ee5af
Instruction ID: 2581e93739e9a87d0f257261ad6b1d48f5806e15370ff68595abb4e014bb3bcd
Opcode Fuzzy Hash: 9a49b9f920199c15ecf1e2b0faad554f7ff7196835fa6b5a59d5ec414b3ee5af
Instruction Fuzzy Hash: C7D14831702612CFCB29EF14C599FA9F7A4BF05710F1542ADE48AAB652DB30AD52CF90

Function 000F7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 000F7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 000F7FC1
GetFileAttributesW.KERNEL32(?), ref: 000F7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 000F8005
SetCurrentDirectoryW.KERNEL32(?), ref: 000F8017
SetCurrentDirectoryW.KERNEL32(?), ref: 000F8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 000F80B0

Strings

*.*, xrefs: 000F8066

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 4a2f5d9fd75048c00d31f0468fb6bf7937db83b0e3eb37b4a50974d71d754927
Instruction ID: 3869126e5352d73d6da9c838effcfc3d5e0fedb0f5fbb89e5a0ad339708018ab
Opcode Fuzzy Hash: 4a2f5d9fd75048c00d31f0468fb6bf7937db83b0e3eb37b4a50974d71d754927
Instruction Fuzzy Hash: DD81D0715082099BCB64EF14C844ABEB3E8BF89310F54886FFA89C7651EB34DD459B93

Function 00085BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00085C7A

Part of subcall function 00085D0A: GetClientRect.USER32(?,?), ref: 00085D30
Part of subcall function 00085D0A: GetWindowRect.USER32(?,?), ref: 00085D71
Part of subcall function 00085D0A: ScreenToClient.USER32(?,?), ref: 00085D99

GetDC.USER32 ref: 000C46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 000C4708
SelectObject.GDI32(00000000,00000000), ref: 000C4716
SelectObject.GDI32(00000000,00000000), ref: 000C472B
ReleaseDC.USER32(?,00000000), ref: 000C4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 000C47C4

Strings

U, xrefs: 000C4693

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 51eddebc18401d2c6e788398dab0b8ba5d7ef01df88474bb41bf91cd9a26fb36
Instruction ID: 21bcddc5c8a4e58ab44542ed0a3d756277c00c793307a286b0f63b108b13e6db
Opcode Fuzzy Hash: 51eddebc18401d2c6e788398dab0b8ba5d7ef01df88474bb41bf91cd9a26fb36
Instruction Fuzzy Hash: F871BC31404205EFCF259F64C9A4FEE3BB6FF4A365F144269ED955A2AAC7308881DF50

Function 000F359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 000F35E4

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

LoadStringW.USER32(00152390,?,00000FFF,?), ref: 000F360A

Strings

Line %d (File "%s"):, xrefs: 000F366B
^ ERROR, xrefs: 000F36C9
"%s" (%d) : ==> %s:, xrefs: 000F3742
"%s" (%d) : ==> %s:%s%s, xrefs: 000F3724
Error: , xrefs: 000F36EF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: e427dd543a0fed22da07fa01310fdd96a1ea7508c6652f95817b59e0bc203114
Instruction ID: 74d9547a50e54db62895bd89860d81236c5aee287a66005871af8e9197164b1e
Opcode Fuzzy Hash: e427dd543a0fed22da07fa01310fdd96a1ea7508c6652f95817b59e0bc203114
Instruction Fuzzy Hash: 7F515A7190020ABADF15FBA0CC42EFEBB78BF14310F184125F605725A2EB311B99DBA1

Function 000FC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 000FC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000FC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 000FC2CA
GetLastError.KERNEL32 ref: 000FC322
SetEvent.KERNEL32(?), ref: 000FC336
InternetCloseHandle.WININET(00000000), ref: 000FC341

Strings

, xrefs: 000FC2BB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: c32e92cde1129ef205793cb2fd2d86a6721fb4f23442a6befa3036cccd6f76bf
Instruction ID: b8b7fef9845a1a37ca01a81e2981d819db11db03174c2f13dc6d8a13afd154c9
Opcode Fuzzy Hash: c32e92cde1129ef205793cb2fd2d86a6721fb4f23442a6befa3036cccd6f76bf
Instruction Fuzzy Hash: 4E31B37150020CAFE7619F648E85EBB7BFCEB45780B04851EF54692A01DB30DD44ABA0

Function 000E989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,000C3AAF,?,?,Bad directive syntax error,0011CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 000E98BC
LoadStringW.USER32(00000000,?,000C3AAF,?), ref: 000E98C3

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 000E9987

Strings

Line %d (File "%s"):, xrefs: 000E992D
Line %d:, xrefs: 000E9912
., xrefs: 000E996D
%s (%d) : ==> %s.: %s %s, xrefs: 000E98F1
Error: , xrefs: 000E9955

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 41bc0a63a22f11df92bd64d73001007519ad3c9c4b45435c62879a1c6e841a9a
Instruction ID: 005c47fd44012da5ee622a801ccd2f7154ab4167ca5561d4f55c061bec4273d8
Opcode Fuzzy Hash: 41bc0a63a22f11df92bd64d73001007519ad3c9c4b45435c62879a1c6e841a9a
Instruction Fuzzy Hash: DC21683294021AABCF15BF90CC0AEEE7779BF19704F084429F515720A3EB719A68DB51

Function 000E209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000E20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 000E20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 000E214D

Strings

list, xrefs: 000E212F
SHELLDLL_DefView, xrefs: 000E20CC
details, xrefs: 000E20FB
largeicons, xrefs: 000E20E1
smallicons, xrefs: 000E2115

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 3219ab8b4d67d2cb5f8af4776598baaf9daed62b5a16cb045180735bc6db8a3a
Instruction ID: 6cc4a9262bd5c220efa8ddf009467fa5873769a6497a11018cd4e540b5ab0ad1
Opcode Fuzzy Hash: 3219ab8b4d67d2cb5f8af4776598baaf9daed62b5a16cb045180735bc6db8a3a
Instruction Fuzzy Hash: 1211027A6C8706BEFB152221EC06DEA379DDB26324B200056FB04B50F3FBA1A9425654

Function 000BCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 000BCEB7
_free.LIBCMT ref: 000BCF22
_free.LIBCMT ref: 000BCF48
_free.LIBCMT ref: 000BCF71
_free.LIBCMT ref: 000BCFA9
_free.LIBCMT ref: 000BCFDA
_free.LIBCMT ref: 000BD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 000BD09C
_free.LIBCMT ref: 000BD0B5

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: d2ea2ed1738cbb56034f2f5636c665b79a8e4190265f1953bfbfcd30bd362bfb
Instruction ID: 68e67b466f5e2e10e4caebc0b908553f06a797d383fbb131bbebf9e2314a0f5c
Opcode Fuzzy Hash: d2ea2ed1738cbb56034f2f5636c665b79a8e4190265f1953bfbfcd30bd362bfb
Instruction Fuzzy Hash: 6761E571904302EBEB61AFF49885AFEBBE5EF05350F0445BEF945AB282E6319E418750

Function 001150D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00115186
ShowWindow.USER32(?,00000000), ref: 001151C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 001151CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 001151D1

Part of subcall function 00116FBA: DeleteObject.GDI32(00000000), ref: 00116FE6

GetWindowLongW.USER32(?,000000F0), ref: 0011520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0011521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0011524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00115287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00115296

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 182f40e234fc9046c0a54cac0770b64e967680432f5eec97b8ab77b41cd77408
Instruction ID: e9963dc50047c0d46aeae2c4197b12c6ba4667f9031e15861a97be9f5ce63df7
Opcode Fuzzy Hash: 182f40e234fc9046c0a54cac0770b64e967680432f5eec97b8ab77b41cd77408
Instruction Fuzzy Hash: 9151B131A90A08FEEF2D9F24CC49BD83B67FB85365F148125F615962E1C7B5A9C0DB40

Function 00098B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 000D6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 000D68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 000D68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 000D68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 000D68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00098874,00000000,00000000,00000000,000000FF,00000000), ref: 000D6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 000D691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00098874,00000000,00000000,00000000,000000FF,00000000), ref: 000D692D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: b4b1a034f0f096bebd24f979536cf499c232c5c6512c66d0ff7e9a9a56e99966
Instruction ID: 91f630aa919431a5e0411f7eb9c751ad2529e5b37a0c72160d73b7ea3e0df155
Opcode Fuzzy Hash: b4b1a034f0f096bebd24f979536cf499c232c5c6512c66d0ff7e9a9a56e99966
Instruction Fuzzy Hash: 98517770600309EFDF24CF24CC55BAA7BF6EB48754F148519F912976A0DB71E990EB90

Function 000FC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 000FC182
GetLastError.KERNEL32 ref: 000FC195
SetEvent.KERNEL32(?), ref: 000FC1A9

Part of subcall function 000FC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 000FC272
Part of subcall function 000FC253: GetLastError.KERNEL32 ref: 000FC322
Part of subcall function 000FC253: SetEvent.KERNEL32(?), ref: 000FC336
Part of subcall function 000FC253: InternetCloseHandle.WININET(00000000), ref: 000FC341

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 65b917423d7c322fa1b3ce64568c9cbda26021f4a6c5f7047aeb3b33461a502a
Instruction ID: 9c8560c924dd6aeffe764acc299035ab39c93409f823f15ccb0195c879d66dc1
Opcode Fuzzy Hash: 65b917423d7c322fa1b3ce64568c9cbda26021f4a6c5f7047aeb3b33461a502a
Instruction Fuzzy Hash: C531B27114060DAFEB659FA5DE45EBABBF8FF58300B04841DFA5682A11D730E854EBA0

Function 000E25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000E3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 000E3A57
Part of subcall function 000E3A3D: GetCurrentThreadId.KERNEL32 ref: 000E3A5E
Part of subcall function 000E3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,000E25B3), ref: 000E3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 000E25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 000E25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 000E25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 000E25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 000E2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 000E2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 000E260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 000E2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 000E2627

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 0174660bc739e333fb3d3c6d7ce23f9e019c4c29eaf2bc8433ba9ed140c37e75
Instruction ID: cb6129e543f7b1395eb4f4a95efe62660d1c1cce9b4107767c5635c3c8f88a99
Opcode Fuzzy Hash: 0174660bc739e333fb3d3c6d7ce23f9e019c4c29eaf2bc8433ba9ed140c37e75
Instruction Fuzzy Hash: 7501B1313D0754BBFB2067699C8AFD93E99DB4AB12F104011F318AF1D1C9E22484CAAA

Function 000E1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,000E1449,?,?,00000000), ref: 000E180C
HeapAlloc.KERNEL32(00000000,?,000E1449,?,?,00000000), ref: 000E1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,000E1449,?,?,00000000), ref: 000E1828
GetCurrentProcess.KERNEL32(?,00000000,?,000E1449,?,?,00000000), ref: 000E1830
DuplicateHandle.KERNEL32(00000000,?,000E1449,?,?,00000000), ref: 000E1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,000E1449,?,?,00000000), ref: 000E1843
GetCurrentProcess.KERNEL32(000E1449,00000000,?,000E1449,?,?,00000000), ref: 000E184B
DuplicateHandle.KERNEL32(00000000,?,000E1449,?,?,00000000), ref: 000E184E
CreateThread.KERNEL32(00000000,00000000,000E1874,00000000,00000000,00000000), ref: 000E1868

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 46d02f77ee5692dad3b55ae9c4426ac079af8bdcdf9ccfa0e6cb4ca2904fe60c
Instruction ID: c0eeed35e6bfe7118940910b04a91201c60980678bb0fc1d7df27b23c7ca0a76
Opcode Fuzzy Hash: 46d02f77ee5692dad3b55ae9c4426ac079af8bdcdf9ccfa0e6cb4ca2904fe60c
Instruction Fuzzy Hash: 9901BFB52C0344FFE710AB65DD4DF977B6CEB89B11F008411FA05DB591CA709840CB60

Function 000B3E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 000B3F0B
__alldvrm.LIBCMT ref: 000B410C
__alldvrm.LIBCMT ref: 000B412E

Strings

}}, xrefs: 000B40CD
}}, xrefs: 000B3E8A
}}, xrefs: 000B3E96, 000B3EF1, 000B3F0A, 000B4090

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}$}}$}}
API String ID: 1036877536-3424312472
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 5485cfafc5494673dfef1614135e96bb9ebab17aea809d6ef67f3c450b8f4596
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: C9A13772E103869FDB25DF18C8917FEBBE5EF62350F28456DE5959B283C2348A81C750

Function 0010A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 000ED4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 000ED501
Part of subcall function 000ED4DC: Process32FirstW.KERNEL32(00000000,?), ref: 000ED50F
Part of subcall function 000ED4DC: CloseHandle.KERNEL32(00000000), ref: 000ED5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0010A16D
GetLastError.KERNEL32 ref: 0010A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0010A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0010A268
GetLastError.KERNEL32(00000000), ref: 0010A273
CloseHandle.KERNEL32(00000000), ref: 0010A2C4

Strings

SeDebugPrivilege, xrefs: 0010A18F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 0614aba88e3fbeee8ac3353fa654ad4be2a007afb7d54d0475ebbd7baaa6c540
Instruction ID: 8633270d590a53753079772e7394d59910e2339736b1d1a12ff81cae4235ef01
Opcode Fuzzy Hash: 0614aba88e3fbeee8ac3353fa654ad4be2a007afb7d54d0475ebbd7baaa6c540
Instruction Fuzzy Hash: 44618D30208341AFE714DF14C494F55BBA1AF54318F55849CE4AA4BBE3C7B2ED85CB92

Function 00113886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00113925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0011393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00113954
_wcslen.LIBCMT ref: 00113999
SendMessageW.USER32(?,00001057,00000000,?), ref: 001139C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 001139F4

Strings

SysListView32, xrefs: 001138F7

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 00703f2fb438994f0f2017135fac69716222d3d5a8f6211fd4cdb38b138876d9
Instruction ID: 67a9c2accf63ab4fb448243de2b1cbdd862f33bfb5947dfc0622d9f3e19d5ffc
Opcode Fuzzy Hash: 00703f2fb438994f0f2017135fac69716222d3d5a8f6211fd4cdb38b138876d9
Instruction Fuzzy Hash: 3441A271A00218ABEF259F64CC49FEA7BA9EF08354F100536F968E7281D7719EC4CB90

Function 000EBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000EBCFD
IsMenu.USER32(00000000), ref: 000EBD1D
CreatePopupMenu.USER32 ref: 000EBD53
GetMenuItemCount.USER32(01165878), ref: 000EBDA4
InsertMenuItemW.USER32(01165878,?,00000001,00000030), ref: 000EBDCC

Strings

0, xrefs: 000EBCA8
2, xrefs: 000EBD37

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 7834b9d88785cb730b17262fcb48b97b39fc801be4ac448e9b91331d8f9a87d7
Instruction ID: c46281f8ead6037f4cfa26e3e66d98dce625d6bed95d5342fddb74d5bf8f6c39
Opcode Fuzzy Hash: 7834b9d88785cb730b17262fcb48b97b39fc801be4ac448e9b91331d8f9a87d7
Instruction Fuzzy Hash: 0251BE70A082899FDB24CFAADD84BEFBBF5AF45314F148219E411BB291E7709941CB51

Function 000A2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 000A2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 000A2D53
_ValidateLocalCookies.LIBCMT ref: 000A2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 000A2E0C
_ValidateLocalCookies.LIBCMT ref: 000A2E61

Strings

csm, xrefs: 000A2DF6
&H, xrefs: 000A2DFE, 000A2E07, 000A2E18

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H$csm
API String ID: 1170836740-3822885207
Opcode ID: 918ffa6ffd1608d7ee053091b058b4e32fca5217275249f474f8ad5aaec1caf4
Instruction ID: 850c324caf26fe646682effbebd51c5ac65549ea666e7f024b1392407c854497
Opcode Fuzzy Hash: 918ffa6ffd1608d7ee053091b058b4e32fca5217275249f474f8ad5aaec1caf4
Instruction Fuzzy Hash: E1418034A01209ABCF10DFACC845ADEBBA5BF46324F148165F8146B293DB35EA55CBD0

Function 000EC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 000EC913

Strings

info, xrefs: 000EC8B4
stop, xrefs: 000EC8E4
warning, xrefs: 000EC8FC
question, xrefs: 000EC8CC
blank, xrefs: 000EC895

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 960522037855072041bd5b31283c7c0e26c899f7fa0e467e12f019c15ed50a7d
Instruction ID: 0359d238afe8ae83eda86f623999c5c3b3c3c9cb027a2c891c44ff3f61d3f151
Opcode Fuzzy Hash: 960522037855072041bd5b31283c7c0e26c899f7fa0e467e12f019c15ed50a7d
Instruction Fuzzy Hash: E8112736689387BEF7049B559D83CEE77DCDF26319B20002AF500B6193EBF65E01526A

Function 000EDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 000EDE42
gethostname.WSOCK32(?,00000100), ref: 000EDE5C
gethostbyname.WSOCK32(?), ref: 000EDE69
inet_ntoa.WSOCK32(?), ref: 000EDEAB
_strcat.LIBCMT ref: 000EDEB9
WSACleanup.WSOCK32 ref: 000EDEDE

Strings

0.0.0.0, xrefs: 000EDE87

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 9f9495ea6d2d182befd6fe437626f5414073f01ee315f943ce835a65fbeebac6
Instruction ID: f7ddbf3c6a4695c1e63a13acca6a860defcae910841b059a78b0c8f9709303e6
Opcode Fuzzy Hash: 9f9495ea6d2d182befd6fe437626f5414073f01ee315f943ce835a65fbeebac6
Instruction Fuzzy Hash: 68112931904119AFCB24BB71DC4EEEF77ACDF52710F00016AF405E6192EFB18AC18A90

Function 00119F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00099BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00099BB2

GetSystemMetrics.USER32(0000000F), ref: 00119FC7
GetSystemMetrics.USER32(0000000F), ref: 00119FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0011A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0011A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0011A263
ShowWindow.USER32(00000003,00000000), ref: 0011A282
InvalidateRect.USER32(?,00000000,00000001), ref: 0011A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 0011A2CA

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 59adfac6f100056b43ac80547546e756e45802865e264437aeb2abf25b7c036c
Instruction ID: 4643155eee0e42fd81a1b30eab8ddf770a7b467ce3d4347397203e572472a1ef
Opcode Fuzzy Hash: 59adfac6f100056b43ac80547546e756e45802865e264437aeb2abf25b7c036c
Instruction Fuzzy Hash: 36B17735601215EBDF18CF68C9857EE7BF2BF48701F498079EC89AB299D731A980CB51

Function 000EED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 000EED2A
_wcslen.LIBCMT ref: 000EED3B
_wcslen.LIBCMT ref: 000EED79
_wcslen.LIBCMT ref: 000EEDAF
_wcslen.LIBCMT ref: 000EEDDF
_wcslen.LIBCMT ref: 000EEDEF
_wcslen.LIBCMT ref: 000EEE2B
_wcslen.LIBCMT ref: 000EEE5A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 6c168866917035ab05333aabf78684fc8ca68c75d397fd3903e7563d6e5e8116
Instruction ID: 3543d9d7184a5b3ddced321e27740aecd79a2dc2fcda72af82a2ea98dc529714
Opcode Fuzzy Hash: 6c168866917035ab05333aabf78684fc8ca68c75d397fd3903e7563d6e5e8116
Instruction Fuzzy Hash: 07418065C10298A9CB11EBF5CC8AACFB7ACAF46710F508462E515F3122EB34E255C3A5

Function 0009F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,000D682C,00000004,00000000,00000000), ref: 0009F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,000D682C,00000004,00000000,00000000), ref: 000DF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,000D682C,00000004,00000000,00000000), ref: 000DF454

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 982725664894ba81661f25025761d275d3338a5f5d7ed3456f970715b0aaf342
Instruction ID: c2950d2c90445e0495d71c402406da95dfb257f4e970476a37aa49e542adbd8e
Opcode Fuzzy Hash: 982725664894ba81661f25025761d275d3338a5f5d7ed3456f970715b0aaf342
Instruction Fuzzy Hash: 0D413B31218742BECFB99B28C98877E7BD2AB57314F14C43DE047D6A61C671A9C0EB61

Function 00112D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00112D1B
GetDC.USER32(00000000), ref: 00112D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00112D2E
ReleaseDC.USER32(00000000,00000000), ref: 00112D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00112D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00112D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00115A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00112DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00112DE1

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 63a227f9bbd1d1df227b7e4ad8bbd353feaa66613541e0e892e215e547ee865a
Instruction ID: ca045d4c08d29b72c03b1ab6736ddc1f53edcdf80be20e4bc6daac6ed01e93ae
Opcode Fuzzy Hash: 63a227f9bbd1d1df227b7e4ad8bbd353feaa66613541e0e892e215e547ee865a
Instruction Fuzzy Hash: A9319F76241214BFEF194F50DC89FEB3BA9EF09711F048065FE089A291D6759C90C7A4

Function 000E5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 000E5637
_memcmp.LIBVCRUNTIME ref: 000E5659
_memcmp.LIBVCRUNTIME ref: 000E5671
_memcmp.LIBVCRUNTIME ref: 000E5684
_memcmp.LIBVCRUNTIME ref: 000E569E
_memcmp.LIBVCRUNTIME ref: 000E56B1
_memcmp.LIBVCRUNTIME ref: 000E56C9
_memcmp.LIBVCRUNTIME ref: 000E56E4

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: d3873452e07a725eed2073e610ed00b2c6c28aed41ab6883cf5bafe239d2f9f8
Instruction ID: 3e171ab7e8af078424c34d4fbd918186244166e68d66457cbed7bc3704fbd580
Opcode Fuzzy Hash: d3873452e07a725eed2073e610ed00b2c6c28aed41ab6883cf5bafe239d2f9f8
Instruction Fuzzy Hash: 4B21D772744A497FD6189A229E92FFF339CAF2138AF440434FD04AB582F760EE1181E5

Function 00104FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00105007
NULL Pointer assignment, xrefs: 0010502E, 00105383

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 5cb5d5c98236b4148979c32d8105986c2be4103cc72e46242529410e97066681
Instruction ID: 714f52533aa6193db5878aa4570f04ef8d52a1c4f7748f3dd63882cd08fbbd85
Opcode Fuzzy Hash: 5cb5d5c98236b4148979c32d8105986c2be4103cc72e46242529410e97066681
Instruction Fuzzy Hash: E4D1A275A0060A9FDF14CFA8C881BAEB7B6BF48344F148469E955AB281D7B0DD45CF90

Function 000C1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 000C15CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 000C1651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 000C16E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 000C16FB

Part of subcall function 000B3820: RtlAllocateHeap.NTDLL(00000000,?,00151444,?,0009FDF5,?,?,0008A976,00000010,00151440,000813FC,?,000813C6,?,00081129), ref: 000B3852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 000C1777
__freea.LIBCMT ref: 000C17A2
__freea.LIBCMT ref: 000C17AE

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 7d7992e5f2b8e38591b0647fe3f1346e4f4ff910d026cb48f3fdedb1795e5651
Instruction ID: c48a194fc937001c5249a06699d9fad550c8573f4139e5325f0d92ba7cb71078
Opcode Fuzzy Hash: 7d7992e5f2b8e38591b0647fe3f1346e4f4ff910d026cb48f3fdedb1795e5651
Instruction Fuzzy Hash: 50919171E146169ADF248F64C891FEE7BF5AF4A310F18465DE802E7282DB35DD40CBA0

Function 00104523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00104648
VariantInit.OLEAUT32(?), ref: 00104749
VariantClear.OLEAUT32(?), ref: 00104753
VariantClear.OLEAUT32(?), ref: 001047B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0010472C
Null Object assignment in FOR..IN loop, xrefs: 001045D8, 00104706, 001047BE

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 10152ad88817fcb5a5441b8c693cf80f13994b4e3b3981d789a6dbaffab4914d
Instruction ID: 08ed8b4ee4564dcf7f01f9e623ca93fd2eb7f08001f5a6aa44155aea2b7ea1b8
Opcode Fuzzy Hash: 10152ad88817fcb5a5441b8c693cf80f13994b4e3b3981d789a6dbaffab4914d
Instruction Fuzzy Hash: C49182B1A00219ABDF24CFA5C884FEE77B8EF46714F108559F645AB2C1D7B09941CFA0

Function 000F1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 000F125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 000F1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 000F12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 000F12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 000F135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 000F13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 000F1430

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: bde09b52a3662a886c33deb5fda13b8860ff97a7b4e336bff380ba59d72bf906
Instruction ID: 5afacc151c93f9728f67da928d08e28f33e8b3ccc2cceba052171c96facaf198
Opcode Fuzzy Hash: bde09b52a3662a886c33deb5fda13b8860ff97a7b4e336bff380ba59d72bf906
Instruction Fuzzy Hash: AD91CF71A00209EFDB44DF94C884BFEB7B5FF44324F104029EA50EBA92D779A941EB90

Function 0009948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 52e5410fc6b6d916ff54a6427d8ca3867f3287189a356f334254ca003d70b94d
Instruction ID: 6fe0ca998c7ccb9f2912540ee78ad09b201f61c75ef930b43e12e15b412fa9be
Opcode Fuzzy Hash: 52e5410fc6b6d916ff54a6427d8ca3867f3287189a356f334254ca003d70b94d
Instruction Fuzzy Hash: B4913571D40219EFCF15CFA9C884AEEBBB8FF49320F14815AE515B7251D374AA81DBA0

Function 00103947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0010396B
CharUpperBuffW.USER32(?,?), ref: 00103A7A
_wcslen.LIBCMT ref: 00103A8A
VariantClear.OLEAUT32(?), ref: 00103C1F

Part of subcall function 000F0CDF: VariantInit.OLEAUT32(00000000), ref: 000F0D1F
Part of subcall function 000F0CDF: VariantCopy.OLEAUT32(?,?), ref: 000F0D28
Part of subcall function 000F0CDF: VariantClear.OLEAUT32(?), ref: 000F0D34

Strings

Incorrect Parameter format, xrefs: 001039A6, 00103BA1
AUTOIT.ERROR, xrefs: 00103A80, 00103A85

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 87e3bf46f200d4ad565fc315d0a826c53549471018da65ae74b4c1bd5ae1d3c5
Instruction ID: f4117675cf7f05c81f88ecc4f1d6c4c936464758341cf0c35de0b962a8324524
Opcode Fuzzy Hash: 87e3bf46f200d4ad565fc315d0a826c53549471018da65ae74b4c1bd5ae1d3c5
Instruction Fuzzy Hash: CE9148756083059FC704EF24C48096AB7E8BF89314F14882DF8D997392DB71EE45CB92

Function 00104BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 000E000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,000DFF41,80070057,?,?,?,000E035E), ref: 000E002B
Part of subcall function 000E000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,000DFF41,80070057,?,?), ref: 000E0046
Part of subcall function 000E000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,000DFF41,80070057,?,?), ref: 000E0054
Part of subcall function 000E000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,000DFF41,80070057,?), ref: 000E0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00104C51
_wcslen.LIBCMT ref: 00104D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00104DCF
CoTaskMemFree.OLE32(?), ref: 00104DDA

Strings

NULL Pointer assignment, xrefs: 00104E23, 00104E52

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 0646fdd465f640bbe290631c2ccd68ff2f8d597a3e2bee717952fff2f15a54c1
Instruction ID: b435e9a916ed594479650be185fa182bd4126a53b78730cc95985867494844a9
Opcode Fuzzy Hash: 0646fdd465f640bbe290631c2ccd68ff2f8d597a3e2bee717952fff2f15a54c1
Instruction Fuzzy Hash: BD9108B1D002199FDF14EFA4D891AEEB7B9BF08310F10816AE555B7291EB749A448FA0

Function 001120FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00112183
GetMenuItemCount.USER32(00000000), ref: 001121B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 001121DD
_wcslen.LIBCMT ref: 00112213
GetMenuItemID.USER32(?,?), ref: 0011224D
GetSubMenu.USER32(?,?), ref: 0011225B

Part of subcall function 000E3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 000E3A57
Part of subcall function 000E3A3D: GetCurrentThreadId.KERNEL32 ref: 000E3A5E
Part of subcall function 000E3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,000E25B3), ref: 000E3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 001122E3

Part of subcall function 000EE97B: Sleep.KERNELBASE ref: 000EE9F3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: cf8273175ca9a53ad3b23a91bb33041ee6fdbe2e47a6dc93f36dfaffa39180c3
Instruction ID: b847c533a84f1d548563396caa8b4b4ad89380338783c4c74242652c27493bdc
Opcode Fuzzy Hash: cf8273175ca9a53ad3b23a91bb33041ee6fdbe2e47a6dc93f36dfaffa39180c3
Instruction Fuzzy Hash: BC719F35A00205AFCB18EFA4C845AEEB7F1FF48310F158469E956EB342D734ED918B90

Function 00117E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(011658C8), ref: 00117F37
IsWindowEnabled.USER32(011658C8), ref: 00117F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0011801E
SendMessageW.USER32(011658C8,000000B0,?,?), ref: 00118051
IsDlgButtonChecked.USER32(?,?), ref: 00118089
GetWindowLongW.USER32(011658C8,000000EC), ref: 001180AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 001180C3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 36426d50c302d228fb22ba0ed366389db6b216186d208f73efb26067ee4b3184
Instruction ID: b020a0413d91203fa1962313a44f9fd349a9074d955d510c58f18ff98f8e1ca5
Opcode Fuzzy Hash: 36426d50c302d228fb22ba0ed366389db6b216186d208f73efb26067ee4b3184
Instruction Fuzzy Hash: 81719E74608205AFEB299F64C884FEBBBB5EF09300F144469F965973A1CB31ACC6CB51

Function 000EAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000EAEF9
GetKeyboardState.USER32(?), ref: 000EAF0E
SetKeyboardState.USER32(?), ref: 000EAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 000EAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 000EAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 000EAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 000EB020

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 07dc4757fc1640a5f82b173e8780365f7c6d27dbed7d9b135b67b41aad343eba
Instruction ID: 3cf990c5237589f7b0c2c565e84776f4a391f3344067878c698eee3d3e684ef3
Opcode Fuzzy Hash: 07dc4757fc1640a5f82b173e8780365f7c6d27dbed7d9b135b67b41aad343eba
Instruction Fuzzy Hash: EA51C1A0A047D53DFB3683768845BBBBEE95B0A304F088489E1D9658D3C398BCC8D791

Function 000EACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 000EAD19
GetKeyboardState.USER32(?), ref: 000EAD2E
SetKeyboardState.USER32(?), ref: 000EAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 000EADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 000EADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 000EAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 000EAE38

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 6f7c9b8ce49fd09f94c45a48dfd2bf7efc35c437912a7b4e6812418e77a0f968
Instruction ID: 3374e787dd3fca35d8b44750a13688bf5b8f37fda79794cfaa770753a30a6e6d
Opcode Fuzzy Hash: 6f7c9b8ce49fd09f94c45a48dfd2bf7efc35c437912a7b4e6812418e77a0f968
Instruction Fuzzy Hash: CE51E7A16087D53DFB3643358C95BBA7EE95F4B300F088489E1D6669C3D294FC88D752

Function 000B542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(000C3CD6,?,?,?,?,?,?,?,?,000B5BA3,?,?,000C3CD6,?,?), ref: 000B5470
__fassign.LIBCMT ref: 000B54EB
__fassign.LIBCMT ref: 000B5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,000C3CD6,00000005,00000000,00000000), ref: 000B552C
WriteFile.KERNEL32(?,000C3CD6,00000000,000B5BA3,00000000,?,?,?,?,?,?,?,?,?,000B5BA3,?), ref: 000B554B
WriteFile.KERNEL32(?,?,00000001,000B5BA3,00000000,?,?,?,?,?,?,?,?,?,000B5BA3,?), ref: 000B5584

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: f8602600a58cfdfb8eab5f9530392f8c4a75817a5335d9b180369033015cd4ec
Instruction ID: 8e768ce1f8f46d7c908dbe0c00796381a2d148e052fb437c2429636274de71e4
Opcode Fuzzy Hash: f8602600a58cfdfb8eab5f9530392f8c4a75817a5335d9b180369033015cd4ec
Instruction Fuzzy Hash: 3151CF70A00B48AFDB21CFA8DC55BEEBBF9EF09302F14415AE555E7291D7309A81CB60

Function 001010B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0010304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0010307A
Part of subcall function 0010304E: _wcslen.LIBCMT ref: 0010309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00101112
WSAGetLastError.WSOCK32 ref: 00101121
WSAGetLastError.WSOCK32 ref: 001011C9
closesocket.WSOCK32(00000000), ref: 001011F9

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: c508e6faf3b1e837291e6e275822c8c3cee79c443843fabad7548a3dfddbc9ea
Instruction ID: 556f7457c167d10345bec79b6d9896562a8bd6b11f9ca71f07d90222a64a9e89
Opcode Fuzzy Hash: c508e6faf3b1e837291e6e275822c8c3cee79c443843fabad7548a3dfddbc9ea
Instruction Fuzzy Hash: A541C431600614AFDB189F24C884BEAB7E9FF45324F148059F9959B2D2C7B4ED81CBE1

Function 000ECF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000EDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,000ECF22,?), ref: 000EDDFD

Part of subcall function 000EDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,000ECF22,?), ref: 000EDE16

lstrcmpiW.KERNEL32(?,?), ref: 000ECF45
MoveFileW.KERNEL32(?,?), ref: 000ECF7F
_wcslen.LIBCMT ref: 000ED005
_wcslen.LIBCMT ref: 000ED01B
SHFileOperationW.SHELL32(?), ref: 000ED061

Strings

\*.*, xrefs: 000ECFF3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: d461320e300460eb7f1da5b90562b8c0249213edbf3dd4b406b9e3e9d76c9050
Instruction ID: eece558f7b15112e1c03329b1040b24da53867fee728a33f68796716fbfa1b3e
Opcode Fuzzy Hash: d461320e300460eb7f1da5b90562b8c0249213edbf3dd4b406b9e3e9d76c9050
Instruction Fuzzy Hash: BB41547194525C9FDF12EBA5C981EDEB7F9AF48380F0000E6E509FB142EB35AA85CB50

Function 00112DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00112E1C
GetWindowLongW.USER32(?,000000F0), ref: 00112E4F
GetWindowLongW.USER32(?,000000F0), ref: 00112E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00112EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00112EE0
GetWindowLongW.USER32(?,000000F0), ref: 00112EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00112F0B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 9a45f820eead927e2bbdcb562887c271af1790d7deca99d10a14fb83f7abe4f4
Instruction ID: c44042cde9377598fcf76fdcff1e175e7f749f75ddf08fd6319f6bd2ec8b8e0a
Opcode Fuzzy Hash: 9a45f820eead927e2bbdcb562887c271af1790d7deca99d10a14fb83f7abe4f4
Instruction Fuzzy Hash: 79311D30646250AFEB298F18DD84FE537E1EB9A721F1541A4F9108F2B2CB71ACA0DB40

Function 000E7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000E7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000E778F
SysAllocString.OLEAUT32(00000000), ref: 000E7792
SysAllocString.OLEAUT32(?), ref: 000E77B0
SysFreeString.OLEAUT32(?), ref: 000E77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 000E77DE
SysAllocString.OLEAUT32(?), ref: 000E77EC

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 81564a3e661c761a9859f94f2defee4b680ca41af2a5fd5108aa17ab70abf4df
Instruction ID: 34d60af0dc37289c782dbc611be586eed8a49f7a454f0cdafd034f5ae444427a
Opcode Fuzzy Hash: 81564a3e661c761a9859f94f2defee4b680ca41af2a5fd5108aa17ab70abf4df
Instruction Fuzzy Hash: 64218E76608219AFDF14DFA9CC88CFB77ECEB097647048025FA59EB151D670DC8287A0

Function 000E77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000E7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000E7868
SysAllocString.OLEAUT32(00000000), ref: 000E786B
SysAllocString.OLEAUT32 ref: 000E788C
SysFreeString.OLEAUT32 ref: 000E7895
StringFromGUID2.OLE32(?,?,00000028), ref: 000E78AF
SysAllocString.OLEAUT32(?), ref: 000E78BD

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 5ff69880cd4f9df2c36c61850454632595dd894531dea3985c11fd76a4f68915
Instruction ID: 3b9aa5503d48f457ad95073355cb00d5aa1c098b342962f60bf2a4c454b355fc
Opcode Fuzzy Hash: 5ff69880cd4f9df2c36c61850454632595dd894531dea3985c11fd76a4f68915
Instruction Fuzzy Hash: 4221C131648214AFDF149FA9CD88DBA77ECEB183607108025F918DB2A1DA70DC81CB74

Function 000F04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 000F04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 000F052E

Strings

nul, xrefs: 000F0567

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: f3872786602b5db1423be08853125c3d7320efe8c12e934e07c68769fe89cb45
Instruction ID: 73aa53d7ee1e43727bce0f87bcb7aed18afd41d523b5c03c0052a68b897a7dca
Opcode Fuzzy Hash: f3872786602b5db1423be08853125c3d7320efe8c12e934e07c68769fe89cb45
Instruction Fuzzy Hash: 2C218271600709EBDF209F29DC04AAA77E4AF44B24F204A19F9A1D75E1D7B0D940DF60

Function 000F05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 000F05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 000F0601

Strings

nul, xrefs: 000F0639

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: b538aaf40b735b033f5f77318d3fbea3104598dc261814c3fffa14d974f04618
Instruction ID: 433ebceaab35e5f9afe712651f57b3820ab4eda177730b55e31c7cd5f5067e6b
Opcode Fuzzy Hash: b538aaf40b735b033f5f77318d3fbea3104598dc261814c3fffa14d974f04618
Instruction Fuzzy Hash: 3621B5755003199BDB209F68CC04AAA77E8BF85724F204A19FEA1E76E1D7B09960DB50

Function 001140AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0008600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0008604C
Part of subcall function 0008600E: GetStockObject.GDI32(00000011), ref: 00086060
Part of subcall function 0008600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0008606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00114112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0011411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0011412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00114139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00114145

Strings

Msctls_Progress32, xrefs: 001140E3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 81e695307a5ba33d8a67d176a3576ddb49b1b322371f5f693f05eb7bcbd4b941
Instruction ID: 831150a36ae0c988e26e5d9bad67bc96965ff80fd5bc3730c7a70481dc86da28
Opcode Fuzzy Hash: 81e695307a5ba33d8a67d176a3576ddb49b1b322371f5f693f05eb7bcbd4b941
Instruction Fuzzy Hash: 0811B2B2140219BFEF119F64CC85EE77F5DEF09798F014120BA18A6190C7729C61DBA4

Function 000BD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000BD7A3: _free.LIBCMT ref: 000BD7CC

_free.LIBCMT ref: 000BD82D

Part of subcall function 000B29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000), ref: 000B29DE
Part of subcall function 000B29C8: GetLastError.KERNEL32(00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000,00000000), ref: 000B29F0

_free.LIBCMT ref: 000BD838
_free.LIBCMT ref: 000BD843
_free.LIBCMT ref: 000BD897
_free.LIBCMT ref: 000BD8A2
_free.LIBCMT ref: 000BD8AD
_free.LIBCMT ref: 000BD8B8

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: b6971c0deaedf020838120c9c5af380a20802f49dc7df6bf1ad76644540ee570
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 4211D471985B04BBDA21BFB0CC47FCBBBDCAF05700F404C26B29EA6593FA65B5058660

Function 000EDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 000EDA74
LoadStringW.USER32(00000000), ref: 000EDA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 000EDA91
LoadStringW.USER32(00000000), ref: 000EDA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 000EDADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 000EDAB9

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: bc0646397986aef1b4cbe3d7349cc94942da65a6544b82e8c8464741a499c2a1
Instruction ID: 911683b576b0949ac3351565a3d3260b4fdb42cea1a1c4bf8b0d979fb21435a9
Opcode Fuzzy Hash: bc0646397986aef1b4cbe3d7349cc94942da65a6544b82e8c8464741a499c2a1
Instruction Fuzzy Hash: 1B0186F6540208BFE7149BA0DE89EEB736CE708301F4044A2F706E2041E6749EC48FB5

Function 000F096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0115E1A8,0115E1A8), ref: 000F097B
EnterCriticalSection.KERNEL32(0115E188,00000000), ref: 000F098D
TerminateThread.KERNEL32(?,000001F6), ref: 000F099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 000F09A9
CloseHandle.KERNEL32(?), ref: 000F09B8
InterlockedExchange.KERNEL32(0115E1A8,000001F6), ref: 000F09C8
LeaveCriticalSection.KERNEL32(0115E188), ref: 000F09CF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: aade4e178182862e6bd9dd70202722699861d05f9ca576a5e628eff1c07dfc97
Instruction ID: 041851a5f06d91231b3b755c21b0b404a5b7a34a21d9d4356cc3dbdbcb2378d5
Opcode Fuzzy Hash: aade4e178182862e6bd9dd70202722699861d05f9ca576a5e628eff1c07dfc97
Instruction Fuzzy Hash: DBF01932486A12BBD7555BA4EF88AE6BA39BF01702F406025F20290CA1D7B494A5DFD0

Function 00085D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00085D30
GetWindowRect.USER32(?,?), ref: 00085D71
ScreenToClient.USER32(?,?), ref: 00085D99
GetClientRect.USER32(?,?), ref: 00085ED7
GetWindowRect.USER32(?,?), ref: 00085EF8

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 55e4fad5922eb350d567af4d5ab0bfa67451d18a659065c60bcdf20af0ac7eae
Instruction ID: 58f21af0d366b08fa2f674fa38cc915342d07da58248826154198f93d71d6f09
Opcode Fuzzy Hash: 55e4fad5922eb350d567af4d5ab0bfa67451d18a659065c60bcdf20af0ac7eae
Instruction Fuzzy Hash: BBB17C34A0074ADBDB24DFA9C880BEEB7F1FF58311F14841AE8A9D7250DB34AA51DB50

Function 000B01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 000B00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000B00D6
__allrem.LIBCMT ref: 000B00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000B010B
__allrem.LIBCMT ref: 000B0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000B0140

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 9a16ef79706b6e21a3eaae8e7e200b33b978cd810ba61e8625afb5cc45cfbcc2
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 6581C572A007069FE724AFA8CC42BEB73E9AF42764F24453EF551D7682E7B5D9008790

Function 00101D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00103149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,0010101C,00000000,?,?,00000000), ref: 00103195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00101DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00101DE1
WSAGetLastError.WSOCK32 ref: 00101DF2
inet_ntoa.WSOCK32(?), ref: 00101E8C
htons.WSOCK32(?,?,?,?,?), ref: 00101EDB
_strlen.LIBCMT ref: 00101F35

Part of subcall function 000E39E8: _strlen.LIBCMT ref: 000E39F2

Part of subcall function 00086D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,0009CF58,?,?,?), ref: 00086DBA
Part of subcall function 00086D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,0009CF58,?,?,?), ref: 00086DED

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 15cd43acbdc9a076717b51cff7438a93b085abc160cdf2a3334990f0dba61559
Instruction ID: 62f52e16bcc58d425a2dedd1f7671365c6ddb40094fe65ffd70a1e527f088981
Opcode Fuzzy Hash: 15cd43acbdc9a076717b51cff7438a93b085abc160cdf2a3334990f0dba61559
Instruction Fuzzy Hash: 0EA1DE70204341AFC724EB24C885EAA7BE5BF85318F54894CF4965B2E3CBB5ED46CB91

Function 000B61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,000A82D9,000A82D9,?,?,?,000B644F,00000001,00000001,8BE85006), ref: 000B6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,000B644F,00000001,00000001,8BE85006,?,?,?), ref: 000B62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 000B63D8
__freea.LIBCMT ref: 000B63E5

Part of subcall function 000B3820: RtlAllocateHeap.NTDLL(00000000,?,00151444,?,0009FDF5,?,?,0008A976,00000010,00151440,000813FC,?,000813C6,?,00081129), ref: 000B3852

__freea.LIBCMT ref: 000B63EE
__freea.LIBCMT ref: 000B6413

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 14399dfab42d727af20444c0c5e50e3213032e82fba324cc485bf8a32d2d0cdd
Instruction ID: 3ba36a54591f26574dc00668d2a1ddaa63d336fbd4e468cbae62ba32ed6f832a
Opcode Fuzzy Hash: 14399dfab42d727af20444c0c5e50e3213032e82fba324cc485bf8a32d2d0cdd
Instruction Fuzzy Hash: 8E51E172A00616ABEB258F64DC81EFF77E9EB44B50F244629FD05D7141DB3ADD80C6A0

Function 0010BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 0010C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0010B6AE,?,?), ref: 0010C9B5
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010C9F1
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010CA68
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0010BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0010BD25
RegCloseKey.ADVAPI32(00000000), ref: 0010BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0010BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0010BDF3
RegCloseKey.ADVAPI32(?), ref: 0010BDFF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 9451d38ec628bed875ee9e44b5e7407f76f97d77339f8a389468fd91f6d1bda4
Instruction ID: 39158008c6c0acb11f68760d8b13410e5c46d1928880857a5722c37e0b22f39e
Opcode Fuzzy Hash: 9451d38ec628bed875ee9e44b5e7407f76f97d77339f8a389468fd91f6d1bda4
Instruction Fuzzy Hash: DA817D30208241AFD714EF64C885E6ABBE5FF84308F14856DF4998B2A2DB71ED45CB92

Function 000DF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 000DF7B9
SysAllocString.OLEAUT32(00000001), ref: 000DF860
VariantCopy.OLEAUT32(000DFA64,00000000), ref: 000DF889
VariantClear.OLEAUT32(000DFA64), ref: 000DF8AD
VariantCopy.OLEAUT32(000DFA64,00000000), ref: 000DF8B1
VariantClear.OLEAUT32(?), ref: 000DF8BB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 2d5aa9f6c7977787cad9a81f12e6e1a197b0f775a7bf68c75f685d74b074147d
Instruction ID: 43424e74368699a14acf4965235d910ba7a73378545fb7a05d00cd69c1c72f0d
Opcode Fuzzy Hash: 2d5aa9f6c7977787cad9a81f12e6e1a197b0f775a7bf68c75f685d74b074147d
Instruction Fuzzy Hash: 1D51C331940312BACF24AB65D8A5BB9B3A5AF45310B24D467E907DF392DB708C40D7B6

Function 000F910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00087620: _wcslen.LIBCMT ref: 00087625

Part of subcall function 00086B57: _wcslen.LIBCMT ref: 00086B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 000F94E5
_wcslen.LIBCMT ref: 000F9506
_wcslen.LIBCMT ref: 000F952D
GetSaveFileNameW.COMDLG32(00000058), ref: 000F9585

Strings

X, xrefs: 000F9412

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 8b106b4500955616172679c090a28e4d9781672b4501a828fbd8b5c13bf4dc1f
Instruction ID: 5e1bbed5d3c612cbe98a2b8c23bb3fbf2121fcb90dc74b2236e9f8fd136f651f
Opcode Fuzzy Hash: 8b106b4500955616172679c090a28e4d9781672b4501a828fbd8b5c13bf4dc1f
Instruction Fuzzy Hash: 44E1B231508301CFD764EF24C881BAAB7E4BF85714F14896DF9899B2A2DB31ED05CB92

Function 0009920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00099BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00099BB2

BeginPaint.USER32(?,?,?), ref: 00099241
GetWindowRect.USER32(?,?), ref: 000992A5
ScreenToClient.USER32(?,?), ref: 000992C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 000992D3
EndPaint.USER32(?,?,?,?,?), ref: 00099321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 000D71EA

Part of subcall function 00099339: BeginPath.GDI32(00000000), ref: 00099357

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 894db6dc859787a7368dbb8be72656d6c3fd0b5b6af91c195293758c408cbd9b
Instruction ID: 7bdb8e0e7ecbafab4000b4823bb696db5594f0ab7406f5d2f1b4f8c38d17576a
Opcode Fuzzy Hash: 894db6dc859787a7368dbb8be72656d6c3fd0b5b6af91c195293758c408cbd9b
Instruction Fuzzy Hash: 7341B270144300EFDB21DF28CC84FAA7BF8EB56325F04462DF9558B2A2D7319885DB61

Function 000F07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 000F080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 000F0847
EnterCriticalSection.KERNEL32(?), ref: 000F0863
LeaveCriticalSection.KERNEL32(?), ref: 000F08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 000F08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 000F0921

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: ea022854bb5f0abc6f45f2e1f1ad74c2f67a287b7a529a63ee0dfc23fc143b68
Instruction ID: 0337c537d8d492d62b110ebe699443d2b18961872e8991ff8fe388810532d58c
Opcode Fuzzy Hash: ea022854bb5f0abc6f45f2e1f1ad74c2f67a287b7a529a63ee0dfc23fc143b68
Instruction Fuzzy Hash: 11416B71A00209EBDF14AF54DC85AAA77B8FF04310F1480A5ED00DA297DB70DE65EBA0

Function 001181DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,000DF3AB,00000000,?,?,00000000,?,000D682C,00000004,00000000,00000000), ref: 0011824C
EnableWindow.USER32(?,00000000), ref: 00118272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 001182D1
ShowWindow.USER32(?,00000004), ref: 001182E5
EnableWindow.USER32(?,00000001), ref: 0011830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0011832F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 47742c69a4563769c4f5ddde3fb426bd4a54ae3f39c3b6f522a0f6ccf2474cce
Instruction ID: 14f88693205f34b9eb74c4a46a2160c2bce0e725c882009f1a147fbffa775297
Opcode Fuzzy Hash: 47742c69a4563769c4f5ddde3fb426bd4a54ae3f39c3b6f522a0f6ccf2474cce
Instruction Fuzzy Hash: 4B41B234601A44EFDB2ACF14C899BE47BF1BB0A715F1881B9E5184F2A2CB71ACC1CB50

Function 000E4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 000E4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 000E4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 000E4CEA
_wcslen.LIBCMT ref: 000E4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 000E4D10
_wcsstr.LIBVCRUNTIME ref: 000E4D1A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: c5e85841e76d45a56b3c111b33233bf9ab82164733c1c72db9d1586e60e176a7
Instruction ID: fd03e21921eea513b9488432c87a365b1f734d0935b4fe7af4ed275d6046efd4
Opcode Fuzzy Hash: c5e85841e76d45a56b3c111b33233bf9ab82164733c1c72db9d1586e60e176a7
Instruction Fuzzy Hash: FC212632208240BFEB695B3AAC49EBF7BDCDF45750F108039F805DA292EA71DC40D2A0

Function 000F581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00083AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00083A97,?,?,00082E7F,?,?,?,00000000), ref: 00083AC2

_wcslen.LIBCMT ref: 000F587B
CoInitialize.OLE32(00000000), ref: 000F5995
CoCreateInstance.OLE32(0011FCF8,00000000,00000001,0011FB68,?), ref: 000F59AE
CoUninitialize.OLE32 ref: 000F59CC

Strings

.lnk, xrefs: 000F5876, 000F58C1, 000F5985

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: f1b55e22822249484456066a7091360d08af718faea752dcff78872da05069ad
Instruction ID: 70021e760951ed9555e459a2300d7715133a0907557536c7fcb334c6f8b20203
Opcode Fuzzy Hash: f1b55e22822249484456066a7091360d08af718faea752dcff78872da05069ad
Instruction Fuzzy Hash: C4D175706087059FC714EF14C880A6ABBE1FF89715F14885DFA899B762DB31EC45CB92

Function 000E175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000E0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 000E0FCA
Part of subcall function 000E0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 000E0FD6
Part of subcall function 000E0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 000E0FE5
Part of subcall function 000E0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 000E0FEC
Part of subcall function 000E0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 000E1002

GetLengthSid.ADVAPI32(?,00000000,000E1335), ref: 000E17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 000E17BA
HeapAlloc.KERNEL32(00000000), ref: 000E17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 000E17DA
GetProcessHeap.KERNEL32(00000000,00000000,000E1335), ref: 000E17EE
HeapFree.KERNEL32(00000000), ref: 000E17F5

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 67690cb20107b0a95c8b0e9e8347d6d05b56ca94d6d3c8001238a1a8ddb711a8
Instruction ID: 23eda590aae0696149a8b900444b47f4f7e9ffa3f6c46bd66fa3e74fb3cedfa3
Opcode Fuzzy Hash: 67690cb20107b0a95c8b0e9e8347d6d05b56ca94d6d3c8001238a1a8ddb711a8
Instruction Fuzzy Hash: 4211BB32688605FFDB249FA5CD49BEE7BF9EF45755F108058F881A7210C736A980CBA0

Function 000E14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 000E14FF
OpenProcessToken.ADVAPI32(00000000), ref: 000E1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 000E1515
CloseHandle.KERNEL32(00000004), ref: 000E1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 000E154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 000E1563

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 6898b18cc57db236053dad7b5534aa23eee86c8bd5ab6809cb4947e444cd174c
Instruction ID: 99e1308d8548bbfb270b5847e6a6e3b831ccbef4239b58f3fd0d2c974712172c
Opcode Fuzzy Hash: 6898b18cc57db236053dad7b5534aa23eee86c8bd5ab6809cb4947e444cd174c
Instruction Fuzzy Hash: D11129B2540249EFDF118F98DE49BDE7BA9FF48744F048015FA05A21A0C3758EA0DBA0

Function 000A3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000A3379,000A2FE5), ref: 000A3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000A339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000A33B7
SetLastError.KERNEL32(00000000,?,000A3379,000A2FE5), ref: 000A3409

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3bf645c5796eca6fae005484db00fe7f97c412dddb44455136907da4cc9cdae9
Instruction ID: 8ecc42389d5f79b86925d21fc45ffdcc95087d629b4095750acf0810e350c5f4
Opcode Fuzzy Hash: 3bf645c5796eca6fae005484db00fe7f97c412dddb44455136907da4cc9cdae9
Instruction Fuzzy Hash: B501473B60E311BEAAA827F47C855AB2AD4EB073793204229F520826F2EF114E415184

Function 000B2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000B5686,000C3CD6,?,00000000,?,000B5B6A,?,?,?,?,?,000AE6D1,?,00148A48), ref: 000B2D78
_free.LIBCMT ref: 000B2DAB
_free.LIBCMT ref: 000B2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,000AE6D1,?,00148A48,00000010,00084F4A,?,?,00000000,000C3CD6), ref: 000B2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,000AE6D1,?,00148A48,00000010,00084F4A,?,?,00000000,000C3CD6), ref: 000B2DEC
_abort.LIBCMT ref: 000B2DF2

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: d91699b3a1cabaee56b8fe7a6b0436f650389c0d5e1f2cd138b204ebe94a328a
Instruction ID: c748c30bf3af869ccc3454419de7d9f7f39193fb96c4c4a1e9a1c3cd3756d854
Opcode Fuzzy Hash: d91699b3a1cabaee56b8fe7a6b0436f650389c0d5e1f2cd138b204ebe94a328a
Instruction Fuzzy Hash: F2F0F636545A0077C6A63778BC0AEDF2AA9BFC6BA1F354518F838D65E7EF248C4141A0

Function 00118A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00099639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00099693
Part of subcall function 00099639: SelectObject.GDI32(?,00000000), ref: 000996A2
Part of subcall function 00099639: BeginPath.GDI32(?), ref: 000996B9
Part of subcall function 00099639: SelectObject.GDI32(?,00000000), ref: 000996E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00118A4E
LineTo.GDI32(?,00000003,00000000), ref: 00118A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00118A70
LineTo.GDI32(?,00000000,00000003), ref: 00118A80
EndPath.GDI32(?), ref: 00118A90
StrokePath.GDI32(?), ref: 00118AA0

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: cd0a8ba14cd007ca2a691cfa3ea914873a91cc568e6ccb98bbd354a177476b0b
Instruction ID: ce74fd383d0279fe844d546b4620d798771a4fbc931b4635f5899f4594d25ce7
Opcode Fuzzy Hash: cd0a8ba14cd007ca2a691cfa3ea914873a91cc568e6ccb98bbd354a177476b0b
Instruction Fuzzy Hash: 7D11F776040118FFDB129F94DC88EEA7F6CEB08354F00C422BA199A5A1C7719D95DFA0

Function 000E51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 000E5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 000E5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000E5230
ReleaseDC.USER32(00000000,00000000), ref: 000E5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 000E524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 000E5261

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 0435afc2b68f406056f7e8a1ee18fa9eaa18e2ef4c4a9acbbefb795a2ee7f6e4
Instruction ID: 37be57d812d3ad5e2d3a7d6bf790066259538ba22ef5ed129e07b8a37bf8b351
Opcode Fuzzy Hash: 0435afc2b68f406056f7e8a1ee18fa9eaa18e2ef4c4a9acbbefb795a2ee7f6e4
Instruction Fuzzy Hash: 1B01A275E40708BBEB149BA69D49E9EBFB8EF48351F048065FA08A7381D670DC00CFA0

Function 00081BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00081BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00081BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00081C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00081C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00081C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00081C22

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 5e3938118b3f34ffa7a59bebca202c0e07ff228b50910b0bddfd15be3a4e547b
Instruction ID: c9c2711cdac7fbb50c53e39a1a9f24dec6b3dfa74b463324f21354566886e4b4
Opcode Fuzzy Hash: 5e3938118b3f34ffa7a59bebca202c0e07ff228b50910b0bddfd15be3a4e547b
Instruction Fuzzy Hash: 2D016CB0942759BDE3008F5A8C85B52FFA8FF19354F00411B915C47A41C7F5A864CBE5

Function 000EEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 000EEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 000EEB46
GetWindowThreadProcessId.USER32(?,?), ref: 000EEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000EEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000EEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000EEB75

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: be314ace50cec5ad002f0ae604de45768733cd860e0da6cd93bbd53ede022654
Instruction ID: f25b4d3dec78524671e9cffa90d2e11471c9df5fcd6aa0348a2940fe5c22df63
Opcode Fuzzy Hash: be314ace50cec5ad002f0ae604de45768733cd860e0da6cd93bbd53ede022654
Instruction Fuzzy Hash: A8F09A72280168BFE7255B62DD0EEEF3A7CEFCAB11F008158F601E1190E7A01A41CAF4

Function 000D7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 000D7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 000D7469
GetWindowDC.USER32(?), ref: 000D7475
GetPixel.GDI32(00000000,?,?), ref: 000D7484
ReleaseDC.USER32(?,00000000), ref: 000D7496
GetSysColor.USER32(00000005), ref: 000D74B0

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: d9e9ac80c59fcb43652b38f608c49f984cf5860a9a37ed98dddd78541c9f915a
Instruction ID: 45a2cb605b3affe5f279b5cde1d3063d02a6569f92bb8c344d4830be9b909a0b
Opcode Fuzzy Hash: d9e9ac80c59fcb43652b38f608c49f984cf5860a9a37ed98dddd78541c9f915a
Instruction Fuzzy Hash: DD01AD31540215FFDB915F64DD08BEEBBB6FF04321F508064F919A26A0DB311E81EBA0

Function 000E1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 000E187F
UnloadUserProfile.USERENV(?,?), ref: 000E188B
CloseHandle.KERNEL32(?), ref: 000E1894
CloseHandle.KERNEL32(?), ref: 000E189C
GetProcessHeap.KERNEL32(00000000,?), ref: 000E18A5
HeapFree.KERNEL32(00000000), ref: 000E18AC

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: c0bdf7d4feb1ac461054064e627667405f44b47765b5ced8a3741361d871000a
Instruction ID: 6b99b20c525aba4bc4a583469f58a89aec820b12051bad9bb52f7d60c658bb82
Opcode Fuzzy Hash: c0bdf7d4feb1ac461054064e627667405f44b47765b5ced8a3741361d871000a
Instruction Fuzzy Hash: F6E0ED36484611FBD7055FA1EE0C985BF39FF49721710C220F22581870CB7254A0DF90

Function 00107B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 000A0242: EnterCriticalSection.KERNEL32(0015070C,00151884,?,?,0009198B,00152518,?,?,?,000812F9,00000000), ref: 000A024D
Part of subcall function 000A0242: LeaveCriticalSection.KERNEL32(0015070C,?,0009198B,00152518,?,?,?,000812F9,00000000), ref: 000A028A

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 000A00A3: __onexit.LIBCMT ref: 000A00A9

__Init_thread_footer.LIBCMT ref: 00107BFB

Part of subcall function 000A01F8: EnterCriticalSection.KERNEL32(0015070C,?,?,00098747,00152514), ref: 000A0202
Part of subcall function 000A01F8: LeaveCriticalSection.KERNEL32(0015070C,?,00098747,00152514), ref: 000A0235

Strings

G, xrefs: 00107C7F
+T, xrefs: 00107E2E
5, xrefs: 00107C78
Variable must be of type 'Object'., xrefs: 00107C3A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +T$5$G$Variable must be of type 'Object'.
API String ID: 535116098-3400515646
Opcode ID: c741426ffc17b2d742c044dc8ea1ea827185ebb46e63d1fcf9d2c59704c811c9
Instruction ID: 0ddba232597bea6642a892ddc455d457b432d08463924a72edbd70b510434a00
Opcode Fuzzy Hash: c741426ffc17b2d742c044dc8ea1ea827185ebb46e63d1fcf9d2c59704c811c9
Instruction Fuzzy Hash: B7918B70A04209EFCB04EF94D9919FDB7B1BF49300F148059F886AB2D2DBB1AE85CB51

Function 000EC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00087620: _wcslen.LIBCMT ref: 00087625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 000EC6EE
_wcslen.LIBCMT ref: 000EC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 000EC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 000EC7CA

Strings

0, xrefs: 000EC6AF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 7acff0323b5a5e8af3b2e9b945261ce2f8693f0a902cbc5f46238b59a65486b0
Instruction ID: f4fb2f2f2f1937987643501eccf17ebed7ce5754244a110a73b8195013e0e101
Opcode Fuzzy Hash: 7acff0323b5a5e8af3b2e9b945261ce2f8693f0a902cbc5f46238b59a65486b0
Instruction Fuzzy Hash: 1E51F0716083809FE7959F2AC844FAB77E4AF45314F04092DF8E1E2191DB72CC468B52

Function 0010AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0010AEA3

Part of subcall function 00087620: _wcslen.LIBCMT ref: 00087625

GetProcessId.KERNEL32(00000000), ref: 0010AF38
CloseHandle.KERNEL32(00000000), ref: 0010AF67

Strings

<, xrefs: 0010AE6B
@, xrefs: 0010AE72

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: ee00838d2cdbab608b805fae8ae19db01eb551b2fd69d2812d14e5ee718eb793
Instruction ID: 0fcfb1037f2f89d9a71576bff270e36668d51d776c6ae4a417b57f69d544d664
Opcode Fuzzy Hash: ee00838d2cdbab608b805fae8ae19db01eb551b2fd69d2812d14e5ee718eb793
Instruction Fuzzy Hash: 45717E71A00615DFCB14EF54C484A9EBBF0FF08314F548499E89AAB792C7B4ED41CBA1

Function 000E719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 000E7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 000E723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 000E724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 000E72CF

Strings

DllGetClassObject, xrefs: 000E7242

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: ced5641302568bc579f1e739d61a94edd2ac812f3323880a97c842f5dbf15e2c
Instruction ID: 5ab65dc4ddef5fd40f89501ef34e8d2d61d95fecd8b8147154681b55eadfa6f7
Opcode Fuzzy Hash: ced5641302568bc579f1e739d61a94edd2ac812f3323880a97c842f5dbf15e2c
Instruction Fuzzy Hash: 804191B1A04245EFDB25CF55C884A9A7BF9EF44310F1480ADBE09AF20AD7B1DD45CBA0

Function 00113D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00113E35
IsMenu.USER32(?), ref: 00113E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00113E92
DrawMenuBar.USER32 ref: 00113EA5

Strings

0, xrefs: 00113D89

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: f590432042b09f5c7241ac599d28e0800d64388b50c483744780eb1b08f669e7
Instruction ID: c9d07fa446a744f935d16e06c413fd226399d3c3adaff32faf677fe4c53adf1c
Opcode Fuzzy Hash: f590432042b09f5c7241ac599d28e0800d64388b50c483744780eb1b08f669e7
Instruction Fuzzy Hash: 03413C75A01309EFDB18DF54D884ADABBB5FF45354F044129E92597290D730AE85CF90

Function 000E1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 000E3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 000E3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 000E1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 000E1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 000E1EA9

Part of subcall function 00086B57: _wcslen.LIBCMT ref: 00086B6A

Strings

ListBox, xrefs: 000E1E25
ComboBox, xrefs: 000E1DF0

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 46ca136b8f2bad14da1116b287bb997f31b1771d9f239e7e8f667735498699fe
Instruction ID: 381b4752e2be0ed89a5a2cc3b68c6381d82ef25ddf86689c7780c910ab84ee97
Opcode Fuzzy Hash: 46ca136b8f2bad14da1116b287bb997f31b1771d9f239e7e8f667735498699fe
Instruction Fuzzy Hash: 49213571A00144BFDB18AB71DC4ACFFB7B9EF41360B144129F822B32E2EB3549498760

Function 0010C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0010C9F1
_wcslen.LIBCMT ref: 0010CA68
_wcslen.LIBCMT ref: 0010CA9E
_wcslen.LIBCMT ref: 0010CAF9
_wcslen.LIBCMT ref: 0010CB2F
_wcslen.LIBCMT ref: 0010CB7F

Strings

HKLM, xrefs: 0010CA98, 0010CA9D
HKEY_LOCAL_MACHINE, xrefs: 0010CA62, 0010CA67

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 97374c07995a21a19f5c02bb3e017091798dbae32a99975ea1881ad9b73a8aef
Instruction ID: a5b435197819fac74893a5d5833354c7afbb6d512d32072bda15ed608e822c59
Opcode Fuzzy Hash: 97374c07995a21a19f5c02bb3e017091798dbae32a99975ea1881ad9b73a8aef
Instruction Fuzzy Hash: 7E31D772B0016ACBCB20EF6C99501BF33926BA1750B564229E8D56B2D5FBF1CD449BE0

Function 00112F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00112F8D
LoadLibraryW.KERNEL32(?), ref: 00112F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00112FA9
DestroyWindow.USER32(?), ref: 00112FB1

Strings

SysAnimate32, xrefs: 00112F68

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 100c87d2458eec1dc82ce20018d18a56fe3800443d9d7b8bb6a8c3751c91abff
Instruction ID: 7861c12522e398c2ab2ffd374d07f9789ad990e372e151db97bbf2a0e1077c66
Opcode Fuzzy Hash: 100c87d2458eec1dc82ce20018d18a56fe3800443d9d7b8bb6a8c3751c91abff
Instruction Fuzzy Hash: 09218C7120420AABEB194F64DC84FFB77B9EB59364F104628F950D61A0D771DCE29760

Function 000A4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,000A4D1E,000B28E9,?,000A4CBE,000B28E9,001488B8,0000000C,000A4E15,000B28E9,00000002), ref: 000A4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000A4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,000A4D1E,000B28E9,?,000A4CBE,000B28E9,001488B8,0000000C,000A4E15,000B28E9,00000002,00000000), ref: 000A4DC3

Strings

CorExitProcess, xrefs: 000A4D98
mscoree.dll, xrefs: 000A4D86

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: df4905a63d2bf40658be3fd11564392fcedf9bc2f2291a221c57fdebe43afa28
Instruction ID: b24fa25aee86347f2840f81268712b2b44419242e56a6e5f9a1ad37367694901
Opcode Fuzzy Hash: df4905a63d2bf40658be3fd11564392fcedf9bc2f2291a221c57fdebe43afa28
Instruction Fuzzy Hash: D7F0AF39A80218FBDB159F94DC49BEDBBF4EF84711F0041A8F805A2660DB709980CAD0

Function 000DD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000DD3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 000DD3BF
FreeLibrary.KERNEL32(00000000), ref: 000DD3E5

Strings

GetSystemWow64DirectoryW, xrefs: 000DD3B9
X64, xrefs: 000DD2A8

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 31473e42952fd6fd1cac92756a9556f164324be872f5babc722f6193076fd382
Instruction ID: cbcf5a03190a853023601ec66b85cb8ee281c39964e99bdff73607f4c6988668
Opcode Fuzzy Hash: 31473e42952fd6fd1cac92756a9556f164324be872f5babc722f6193076fd382
Instruction Fuzzy Hash: DAF0A0718C5721EBDBB917248D68ABD7264AF21701F558167E806F6255EB20CE808AE2

Function 00084E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00084EDD,?,00151418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00084E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00084EAE
FreeLibrary.KERNEL32(00000000,?,?,00084EDD,?,00151418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00084EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00084EA8
kernel32.dll, xrefs: 00084E94

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: fd13ad394048534d67af892077cb009c3057fb68fd350d6612e3b25ad5ea4583
Instruction ID: 8d086ba7735fd62a985085118da7bdae52acfa2c236c5104d7e830a4aea855ca
Opcode Fuzzy Hash: fd13ad394048534d67af892077cb009c3057fb68fd350d6612e3b25ad5ea4583
Instruction Fuzzy Hash: CBE0CD35A81533EBD2752B256C18BDF66D4BF81F627054115FC00E2110DB60CD4145E0

Function 00084E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,000C3CDE,?,00151418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00084E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00084E74
FreeLibrary.KERNEL32(00000000,?,?,000C3CDE,?,00151418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00084E87

Strings

kernel32.dll, xrefs: 00084E5B
Wow64RevertWow64FsRedirection, xrefs: 00084E6E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 8cdb7d9d3b07f9bebf7fa92b3c16ab6f20670166a1246641ee9d5cc7880048ac
Instruction ID: 43af7939c644d6430deeb0712c04b8152dfaa5d9031c52e54743acab9ce0d5ad
Opcode Fuzzy Hash: 8cdb7d9d3b07f9bebf7fa92b3c16ab6f20670166a1246641ee9d5cc7880048ac
Instruction Fuzzy Hash: C3D0C231582632A786262B246C08DCB2A58BF81B513054130B840E2510DF20CD4186D0

Function 000F2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000F2C05
DeleteFileW.KERNEL32(?), ref: 000F2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 000F2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000F2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000F2CC0

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 1c69d4e7eb029d52c11c2d1f73e51db321078baeb2950c22deece3ff28d15c78
Instruction ID: 7f79674fbd2a0772099e1565786154a044cc39420190fe3dea8c97c908fe383a
Opcode Fuzzy Hash: 1c69d4e7eb029d52c11c2d1f73e51db321078baeb2950c22deece3ff28d15c78
Instruction Fuzzy Hash: 2BB14071D0011DABDF25EBA4CC85EEE7BBDEF49350F1040A6F609E6152EB309A449FA1

Function 0010A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0010A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0010A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0010A468
CloseHandle.KERNEL32(?), ref: 0010A63D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 956bc4d0e7b788bcecaaad6082f686aed99685a0c1f1aa69817fd0dc03bb700f
Instruction ID: bbd9b8acc61c115c5dc8985dcacddb86b2022c22aac78412f0fba910f5eb73a2
Opcode Fuzzy Hash: 956bc4d0e7b788bcecaaad6082f686aed99685a0c1f1aa69817fd0dc03bb700f
Instruction Fuzzy Hash: C9A1AF71604301AFE720EF24D886F6AB7E1BF84714F54881CF59A9B2D2D7B1EC418B92

Function 000EE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000EDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,000ECF22,?), ref: 000EDDFD

Part of subcall function 000EDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,000ECF22,?), ref: 000EDE16

Part of subcall function 000EE199: GetFileAttributesW.KERNEL32(?,000ECF95), ref: 000EE19A

lstrcmpiW.KERNEL32(?,?), ref: 000EE473
MoveFileW.KERNEL32(?,?), ref: 000EE4AC
_wcslen.LIBCMT ref: 000EE5EB
_wcslen.LIBCMT ref: 000EE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 000EE650

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 4828d4f055996bd6a8e1138cd6a6b153b6ecb2be760d61c747ab8a7bb21a66b2
Instruction ID: 1da25af671c78b90341078b026ca2a2e50ab63e93eb312a30d1e6f86322c1cb3
Opcode Fuzzy Hash: 4828d4f055996bd6a8e1138cd6a6b153b6ecb2be760d61c747ab8a7bb21a66b2
Instruction Fuzzy Hash: 575141B25083C99FC764EB90D8819DBB3ECAF85350F00492EF589A3192EE75A5888756

Function 0010B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 0010C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0010B6AE,?,?), ref: 0010C9B5
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010C9F1
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010CA68
Part of subcall function 0010C998: _wcslen.LIBCMT ref: 0010CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0010BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0010BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0010BB63
RegCloseKey.ADVAPI32(?,?), ref: 0010BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0010BBB3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 2857fb85832dd819b9d642f85bdd5dd20f87f316f6e1b655b7d45406039bcd10
Instruction ID: fd4d34a6e04b056bf893db207aa817c890eeb8a61a3835d239d84fa009d559c8
Opcode Fuzzy Hash: 2857fb85832dd819b9d642f85bdd5dd20f87f316f6e1b655b7d45406039bcd10
Instruction Fuzzy Hash: 98614931208241AFD714EF24C491E6ABBE5FF84308F54896DF4998B2A2DB71ED45CB92

Function 000E8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 000E8BCD
VariantClear.OLEAUT32 ref: 000E8C3E
VariantClear.OLEAUT32 ref: 000E8C9D
VariantClear.OLEAUT32(?), ref: 000E8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 000E8D3B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 44ef052d7308a075abcbce39516fe3f7ff2fdd65e1e0ab6be37f9693eaec2e90
Instruction ID: ab304f6ce34b7ab3c26bcdf0c949d94b4b022b7b0241fe5e7dbf1394e2a26f93
Opcode Fuzzy Hash: 44ef052d7308a075abcbce39516fe3f7ff2fdd65e1e0ab6be37f9693eaec2e90
Instruction Fuzzy Hash: D25169B5A00659EFCB14CF69C884AAAB7F9FF89310F158559E909EB350E730E911CF90

Function 000F8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 000F8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 000F8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 000F8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 000F8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 000F8C5F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: ce131f5d18ae11d143dfc1d9c3a6378ebdc40709fdcc3cdbfe340b340ce881ed
Instruction ID: d632f4dbce69e7ce59735875a611b3d160262171e02cc316e1161019b4b91aaf
Opcode Fuzzy Hash: ce131f5d18ae11d143dfc1d9c3a6378ebdc40709fdcc3cdbfe340b340ce881ed
Instruction Fuzzy Hash: 4F514835A006199FCB04EF64C880AADBBF5FF48314F08C058E949AB362DB31ED41DBA0

Function 00108EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00108F40
GetProcAddress.KERNEL32(00000000,?), ref: 00108FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00108FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00109032
FreeLibrary.KERNEL32(00000000), ref: 00109052

Part of subcall function 0009F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,000F1043,?,753CE610), ref: 0009F6E6
Part of subcall function 0009F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,000DFA64,00000000,00000000,?,?,000F1043,?,753CE610,?,000DFA64), ref: 0009F70D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: eda7f06593295de496fb8d18932481ff70708266fe534b0c65ff37879d39a4d9
Instruction ID: 99c0c009c99316d8e7da4b812e665f046a00d3b9803de93739a42bd988903c34
Opcode Fuzzy Hash: eda7f06593295de496fb8d18932481ff70708266fe534b0c65ff37879d39a4d9
Instruction Fuzzy Hash: D0515E34604205DFC715EF68C4948EDBBF1FF49314B4980A8E8859B7A2DB71ED85CB90

Function 00116B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00116C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00116C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00116C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,000FAB79,00000000,00000000), ref: 00116C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00116CC7

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: af77f052136ceaca51f8b808ed7e33ffffa7984d3591f7e931d50ef191e21dbc
Instruction ID: f75817a08d3da9afb7fb7f657d2759bb0fcfdd71c4aed2beb424541666a598bf
Opcode Fuzzy Hash: af77f052136ceaca51f8b808ed7e33ffffa7984d3591f7e931d50ef191e21dbc
Instruction Fuzzy Hash: CB419035A04114AFDB2CCF28CD58FE97BA5EB09350F154278F999A72E0D372AD81DA90

Function 000B2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000B20C3
_free.LIBCMT ref: 000B20E3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ed8739c734479025ea861a7d20e20f62b299c39365b31f3fd05817563f13ec02
Instruction ID: 0d0a764dd649503907719c7e1189fd46cc8e62dd14fe6057fe5200afa5dd6bcc
Opcode Fuzzy Hash: ed8739c734479025ea861a7d20e20f62b299c39365b31f3fd05817563f13ec02
Instruction Fuzzy Hash: 4B41E476A00200AFCB24EF78C881ADDB7F5EF89314F154568E615EB356DB31AD01DB80

Function 0009912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00099141
ScreenToClient.USER32(00000000,?), ref: 0009915E
GetAsyncKeyState.USER32(00000001), ref: 00099183
GetAsyncKeyState.USER32(00000002), ref: 0009919D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 15bd0e3e29bcb7bf002c8112c851f8fcd1b9f0d52a3ecf84a7425954459c7c97
Instruction ID: eafe1f77eefef6cb62dc4b379c4fe95f3e67c404a7be9c50caaefbe5d5defad9
Opcode Fuzzy Hash: 15bd0e3e29bcb7bf002c8112c851f8fcd1b9f0d52a3ecf84a7425954459c7c97
Instruction Fuzzy Hash: 7141547560861AFBDF199F68C844BEDB7B5FF05320F10831AE429A72D0D7305990DBA1

Function 000F3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 000F38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 000F3922
TranslateMessage.USER32(?), ref: 000F394B
DispatchMessageW.USER32(?), ref: 000F3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000F3966

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: e2ebc6573e3b4840f02466ed56b5efc3bee4bfbb6c43d75029bd7cf93ec8f66f
Instruction ID: 78dc39a0aa8b4beb7687557ce13be062c16cee52a8d2fc205910577f5dcc0429
Opcode Fuzzy Hash: e2ebc6573e3b4840f02466ed56b5efc3bee4bfbb6c43d75029bd7cf93ec8f66f
Instruction Fuzzy Hash: 0D310B7050834AEEEB76CB34D808BB637E8AB01365F04055DE662C6DD0E7F49AC5EB11

Function 000FCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 000FCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 000FCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,000FC21E,00000000), ref: 000FCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,000FC21E,00000000), ref: 000FCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,000FC21E,00000000), ref: 000FCFF2

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: da1c5ef5b33671dbbf6baaa5cf9531cfa610cd7cdd5b427d9c5c21333964388e
Instruction ID: 2e2a8aa4304f629e213886422e7c9693db36d5b97d20448becee974d1502e366
Opcode Fuzzy Hash: da1c5ef5b33671dbbf6baaa5cf9531cfa610cd7cdd5b427d9c5c21333964388e
Instruction Fuzzy Hash: 3E315E7150420DAFEB24DFA5CA85DBEBBF9EB14310B10443EE606D2941D730AD44EBA0

Function 000E1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 000E1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 000E19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 000E19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 000E19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 000E19E2

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: dee3087cd350e0c54d2e94969da746e354f266e87c45f706b14d686b50e3e1c1
Instruction ID: 055e4708c8211d084564b99e8a80463ad7c5473d985dd0a20daefde689f51b45
Opcode Fuzzy Hash: dee3087cd350e0c54d2e94969da746e354f266e87c45f706b14d686b50e3e1c1
Instruction Fuzzy Hash: BD31D171A00259EFCB14CFA9CD99AEE3BB5EB44315F108229F921EB2D2C7709D44CB90

Function 00115706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00115745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0011579D
_wcslen.LIBCMT ref: 001157AF
_wcslen.LIBCMT ref: 001157BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00115816

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: bc64c8a648fa1e59d280c2185f204e9093ad82686c55047cbf06555065335411
Instruction ID: 2ef4ef0332a817e17c2ebb6055779c300d1d2016e0d50c5a92ffe25ab8d5bc91
Opcode Fuzzy Hash: bc64c8a648fa1e59d280c2185f204e9093ad82686c55047cbf06555065335411
Instruction Fuzzy Hash: 7521B931904618DADB249FA0CC85AEE7779FF84324F108126F919DB1C0E77089C5CF50

Function 00100930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00100951
GetForegroundWindow.USER32 ref: 00100968
GetDC.USER32(00000000), ref: 001009A4
GetPixel.GDI32(00000000,?,00000003), ref: 001009B0
ReleaseDC.USER32(00000000,00000003), ref: 001009E8

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: b21405aac3242def45244a13f06757a0cbdd9f83daf1941fe36148a324fcea55
Instruction ID: 927c6350445a5fd2a3020c18a812f60e6c773c8f69f25570b7eb4683ae5f8a82
Opcode Fuzzy Hash: b21405aac3242def45244a13f06757a0cbdd9f83daf1941fe36148a324fcea55
Instruction Fuzzy Hash: 63218E75600214AFD704EF65DD84AEEBBF9FF48704F048068E98A977A2CB70AC44DB90

Function 000BCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000BCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000BCDE9

Part of subcall function 000B3820: RtlAllocateHeap.NTDLL(00000000,?,00151444,?,0009FDF5,?,?,0008A976,00000010,00151440,000813FC,?,000813C6,?,00081129), ref: 000B3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 000BCE0F
_free.LIBCMT ref: 000BCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000BCE31

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: ef7b45964df2553fef104b3a15f3187c9c248b7c9612758f884b034082886efc
Instruction ID: e60ee3ffe4055353589510c2cfdc9d0d501a9af8d5ba20f5b44a0067a946c8f9
Opcode Fuzzy Hash: ef7b45964df2553fef104b3a15f3187c9c248b7c9612758f884b034082886efc
Instruction Fuzzy Hash: 58018F72602255BF33211ABA6C88DFF6AADEFC6BA13154129F915DB201EA61CD0181F1

Function 00099639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00099693
SelectObject.GDI32(?,00000000), ref: 000996A2
BeginPath.GDI32(?), ref: 000996B9
SelectObject.GDI32(?,00000000), ref: 000996E2

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 3ba77dd9e023f490a17c67ac9eb971a5bebe669c8aac1cb7cf02561fcab9929f
Instruction ID: 0562ef6fe6d490b9af8aef29fa28b18e4dbdc0ab4f01eae0caad56bcf8d72c1c
Opcode Fuzzy Hash: 3ba77dd9e023f490a17c67ac9eb971a5bebe669c8aac1cb7cf02561fcab9929f
Instruction Fuzzy Hash: 7A218E70802305FBDF129F68ED087ED3BA9BB1136AF10421AF451AA5B0D37099D1DB94

Function 000E5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 000E5726
_memcmp.LIBVCRUNTIME ref: 000E5744
_memcmp.LIBVCRUNTIME ref: 000E5757
_memcmp.LIBVCRUNTIME ref: 000E576F
_memcmp.LIBVCRUNTIME ref: 000E5787

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: d48191d8bffa3d0dee18b2bced64754ff16fbe6bb09ae9a5f81289cb530bc64e
Instruction ID: 41652e8387b56b2633c53c3ac5fbe62d6683071cd0ef8dd8e33b347f140a220e
Opcode Fuzzy Hash: d48191d8bffa3d0dee18b2bced64754ff16fbe6bb09ae9a5f81289cb530bc64e
Instruction Fuzzy Hash: DC01F972249A05FFD61C9512AD42FFB739C9B61399F000434FD04BA241F760EE6192E0

Function 000B2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000AF2DE,000B3863,00151444,?,0009FDF5,?,?,0008A976,00000010,00151440,000813FC,?,000813C6), ref: 000B2DFD
_free.LIBCMT ref: 000B2E32
_free.LIBCMT ref: 000B2E59
SetLastError.KERNEL32(00000000,00081129), ref: 000B2E66
SetLastError.KERNEL32(00000000,00081129), ref: 000B2E6F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 5e001b1109036b823b76eaf5d357dff42dcc8319ad6d205ba36226ec05139445
Instruction ID: 468cb89fc7f665bc00f8c3d90b583b7dd2c36fc81e4e154deb5280589d550e5c
Opcode Fuzzy Hash: 5e001b1109036b823b76eaf5d357dff42dcc8319ad6d205ba36226ec05139445
Instruction Fuzzy Hash: 65012836245A0077C62367766C46DEF26ADFBD57B1B214428F835A32E3EF34CC414060

Function 000E000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,000DFF41,80070057,?,?,?,000E035E), ref: 000E002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,000DFF41,80070057,?,?), ref: 000E0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,000DFF41,80070057,?,?), ref: 000E0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,000DFF41,80070057,?), ref: 000E0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,000DFF41,80070057,?,?), ref: 000E0070

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: d9e216e759335cd386a21afa2af217372321c3a8b274ff915eaf6190cec3e756
Instruction ID: 698afce3048f5a6365ebb72b0e348f22677623d7c10d694858e0953b981947be
Opcode Fuzzy Hash: d9e216e759335cd386a21afa2af217372321c3a8b274ff915eaf6190cec3e756
Instruction Fuzzy Hash: 0201A272640204BFDB109F6ADD44BEA7AEDEF44751F148129F905E2210D7B1DD808BA0

Function 000E10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 000E1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,000E0B9B,?,?,?), ref: 000E1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,000E0B9B,?,?,?), ref: 000E112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,000E0B9B,?,?,?), ref: 000E1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 000E114D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: b4997dcab59167e14cbe47102a27864d502d29e6c35adf7c42dad3b8732711d7
Instruction ID: b0875850730bc6b544ae182de32d0d372bf04ad43d564d7c88864cb24834ab98
Opcode Fuzzy Hash: b4997dcab59167e14cbe47102a27864d502d29e6c35adf7c42dad3b8732711d7
Instruction Fuzzy Hash: 0B018179140305BFDB154F65DD49EAA3FAEFF85360B104454FA41D3350DB71DC408AA0

Function 000E0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 000E0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 000E0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 000E0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 000E0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 000E1002

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 9c7333c7a820001e6d0c1c20a0963bad20b9c5311350b9b0c471d3f6699d0e8a
Instruction ID: 8fbafcfdab20902b4e0d81a31a1879381378cd4484623f232a7571bb0056cfd1
Opcode Fuzzy Hash: 9c7333c7a820001e6d0c1c20a0963bad20b9c5311350b9b0c471d3f6699d0e8a
Instruction Fuzzy Hash: A3F04F39180351FFD7254FA59D49F963BAEEF89761F118414F945D6291CA70DC808AA0

Function 000E1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 000E102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 000E1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000E1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 000E104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000E1062

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 401a9eb259b5a1a40c098612ade117264715256b8748e40db1a48860ceedce5f
Instruction ID: f8f3b8ec19274ed80c20f7dba527538d161be336456ab02156c26ed00333c2e1
Opcode Fuzzy Hash: 401a9eb259b5a1a40c098612ade117264715256b8748e40db1a48860ceedce5f
Instruction Fuzzy Hash: DFF0CD39280301FFDB211FA5ED48F963BAEFF89761F214424FA05D7650CA70D8908AA0

Function 000F030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,000F017D,?,000F32FC,?,00000001,000C2592,?), ref: 000F0324
CloseHandle.KERNEL32(?,?,?,?,000F017D,?,000F32FC,?,00000001,000C2592,?), ref: 000F0331
CloseHandle.KERNEL32(?,?,?,?,000F017D,?,000F32FC,?,00000001,000C2592,?), ref: 000F033E
CloseHandle.KERNEL32(?,?,?,?,000F017D,?,000F32FC,?,00000001,000C2592,?), ref: 000F034B
CloseHandle.KERNEL32(?,?,?,?,000F017D,?,000F32FC,?,00000001,000C2592,?), ref: 000F0358
CloseHandle.KERNEL32(?,?,?,?,000F017D,?,000F32FC,?,00000001,000C2592,?), ref: 000F0365

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 8002c101947bf044a47db2b6149c7155a6a7ebf8dced6a8d61caeddcbdd81289
Instruction ID: 5569c31c45e179ed237c11f247a4f6bae0fb0d06f13e2cffd81c6886e363cbf3
Opcode Fuzzy Hash: 8002c101947bf044a47db2b6149c7155a6a7ebf8dced6a8d61caeddcbdd81289
Instruction Fuzzy Hash: 3C01A272800B199FC7309F66DC80822F7F9BF503153158A3FD29652932C371AA54DF80

Function 000BD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000BD752

Part of subcall function 000B29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000), ref: 000B29DE
Part of subcall function 000B29C8: GetLastError.KERNEL32(00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000,00000000), ref: 000B29F0

_free.LIBCMT ref: 000BD764
_free.LIBCMT ref: 000BD776
_free.LIBCMT ref: 000BD788
_free.LIBCMT ref: 000BD79A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8bdd7b420d336f68144cf202ba0b3f405f3af0df65b0d73bfe5f7191c783ae5d
Instruction ID: fd75f30f5ba5ab791c9df8dfc12285a96321490edb15dfb5ce5ab222be03000d
Opcode Fuzzy Hash: 8bdd7b420d336f68144cf202ba0b3f405f3af0df65b0d73bfe5f7191c783ae5d
Instruction Fuzzy Hash: BBF01236589205BB86A5EB64F9C5CDAB7DDFB457107940C06F148D7912EB30FC8086A4

Function 000E5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 000E5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 000E5C6F
MessageBeep.USER32(00000000), ref: 000E5C87
KillTimer.USER32(?,0000040A), ref: 000E5CA3
EndDialog.USER32(?,00000001), ref: 000E5CBD

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: ce041d3ed6e27754334a438d5ee2d58db31a77a1eb851729d331dafbd67da894
Instruction ID: 311fcda2bbf78b3249268fcfda033f84666f51786258c0f6cf1b84beb841b380
Opcode Fuzzy Hash: ce041d3ed6e27754334a438d5ee2d58db31a77a1eb851729d331dafbd67da894
Instruction Fuzzy Hash: 5E016D30540B44AFEB285B11DE5EFE677B8BB44B0AF004959A683B15E1DBF0A984CA90

Function 000B22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000B22BE

Part of subcall function 000B29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000), ref: 000B29DE
Part of subcall function 000B29C8: GetLastError.KERNEL32(00000000,?,000BD7D1,00000000,00000000,00000000,00000000,?,000BD7F8,00000000,00000007,00000000,?,000BDBF5,00000000,00000000), ref: 000B29F0

_free.LIBCMT ref: 000B22D0
_free.LIBCMT ref: 000B22E3
_free.LIBCMT ref: 000B22F4
_free.LIBCMT ref: 000B2305

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1e41fffb888dc17836e08a53d3a749fbf40917f6f93cefdfe0eca03247698f1f
Instruction ID: 9fe4c31148f1015bac9ec3eacd2ac1d35d0d97a0f034176443acf498d8d1ed30
Opcode Fuzzy Hash: 1e41fffb888dc17836e08a53d3a749fbf40917f6f93cefdfe0eca03247698f1f
Instruction Fuzzy Hash: A5F0F475801311FF8693AF94BC019DC3BA5F719B62B150A07F418DAA72C73109D19FE5

Function 000995C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 000995D4
StrokeAndFillPath.GDI32(?,?,000D71F7,00000000,?,?,?), ref: 000995F0
SelectObject.GDI32(?,00000000), ref: 00099603
DeleteObject.GDI32 ref: 00099616
StrokePath.GDI32(?), ref: 00099631

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: ab3a77e52c08308106a27e00e17833cd6281dd38064d29e16a6ef64926443424
Instruction ID: 99c04e9807ab4ddb873e5042e65df7f092ab2856c29da6cfb3cfdb1e650df51b
Opcode Fuzzy Hash: ab3a77e52c08308106a27e00e17833cd6281dd38064d29e16a6ef64926443424
Instruction Fuzzy Hash: 88F03C34045704FBDB275F69EE1C7A93BA1AB05327F048618F465998F0C73089D1EFA4

Function 000B0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 000B10F9
__freea.LIBCMT ref: 000B1117

Part of subcall function 000B1537: _free.LIBCMT ref: 000B154F

Strings

a/p, xrefs: 000B11DE
am/pm, xrefs: 000B117A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 626345b248ed52627a2a323615e35ac1613c7e7f608a398f4b0a4771fa5d8512
Instruction ID: 94f475434e9f24acb3b98b26ef694ee2452ba192b45622353f8903fd0304f4dc
Opcode Fuzzy Hash: 626345b248ed52627a2a323615e35ac1613c7e7f608a398f4b0a4771fa5d8512
Instruction Fuzzy Hash: ACD14971910206DACB749F68C875BFEB7F1FF06B00FA84119E901AB691E3759E80CB91

Function 000B8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 000B8B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 000B8B7A
__dosmaperr.LIBCMT ref: 000B8B81

Strings

., xrefs: 000B8A63

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .
API String ID: 2434981716-1232320464
Opcode ID: fc105b72bd53d540b3d905abe1a1d4d254bd1a46f01a1e305da67c3a2274f080
Instruction ID: 2bb7e916b857d5bc4bbdc09af203e48fb66ca1f7764f35f970def0480162090d
Opcode Fuzzy Hash: fc105b72bd53d540b3d905abe1a1d4d254bd1a46f01a1e305da67c3a2274f080
Instruction Fuzzy Hash: 724149B0604145AFDB259F68D890EFD7FEADB45304B28C1AAF4858B662DF318C42C790

Function 000E2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000EB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,000E21D0,?,?,00000034,00000800,?,00000034), ref: 000EB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 000E2760

Part of subcall function 000EB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,000E21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 000EB3F8

Part of subcall function 000EB32A: GetWindowThreadProcessId.USER32(?,?), ref: 000EB355
Part of subcall function 000EB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,000E2194,00000034,?,?,00001004,00000000,00000000), ref: 000EB365
Part of subcall function 000EB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,000E2194,00000034,?,?,00001004,00000000,00000000), ref: 000EB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 000E27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 000E281A

Strings

@, xrefs: 000E2832

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: b6868aae330c88b63fb9c4d96dcbf6744a2f98452b6cc61e00193c2894c62065
Instruction ID: 117d16a3e3fc55bfa461bbc751345653d2551f8683cc0b27cf094c695fea7606
Opcode Fuzzy Hash: b6868aae330c88b63fb9c4d96dcbf6744a2f98452b6cc61e00193c2894c62065
Instruction Fuzzy Hash: E1412E72901218AFDB10DFA5CD46AEEBBB8EF09700F104055FA95B7191DB706E85CBA1

Function 000B172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 000B1769
_free.LIBCMT ref: 000B1834
_free.LIBCMT ref: 000B183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 000B1760, 000B1767, 000B1796, 000B17CE

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 8a85040bfb0239c390f7fba8e6304b3c1ffc7328847f59f0398a62d7a4d508f1
Instruction ID: 47c6e13816a38af4d37cc06ed06dc168ab88a4942e1539fd9325dad1b4ef2b70
Opcode Fuzzy Hash: 8a85040bfb0239c390f7fba8e6304b3c1ffc7328847f59f0398a62d7a4d508f1
Instruction Fuzzy Hash: 62316075A44218FFDB22DF999895DDEBBFCEB85310F6441A6F814D7211DA708E80CB90

Function 000EC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 000EC306
DeleteMenu.USER32(?,00000007,00000000), ref: 000EC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00151990,01165878), ref: 000EC395

Strings

0, xrefs: 000EC2DF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: bc58d93b9fe2e97efc63a436bcbec620ffb1e55e858a06758fae418826037f17
Instruction ID: 3515666bb5cb005abc3e73ff1f8758a7a415af7b2329c4bf66857dcb299679c9
Opcode Fuzzy Hash: bc58d93b9fe2e97efc63a436bcbec620ffb1e55e858a06758fae418826037f17
Instruction Fuzzy Hash: BE41A6712043819FE724DF36D844F5ABBE4AF85310F14861DF9A5A72D2D731EA05CB62

Function 00114416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0011CC08,00000000,?,?,?,?), ref: 001144AA
GetWindowLongW.USER32 ref: 001144C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 001144D7

Strings

SysTreeView32, xrefs: 0011447C

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 515d7e41486d6db618c0e9094427e85f684be372f969ad8c969042ba056fc2ce
Instruction ID: a2372cf285cd8e1218b7142f154697aaa048be043c866cacf80ed34fa99352b8
Opcode Fuzzy Hash: 515d7e41486d6db618c0e9094427e85f684be372f969ad8c969042ba056fc2ce
Instruction Fuzzy Hash: 1531AD71200205AFDF289E38DC45BEA7BA9EB08734F204325F975921E1D770EC909B90

Function 0010304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0010335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00103077,?,?), ref: 00103378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0010307A
_wcslen.LIBCMT ref: 0010309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00103106

Strings

255.255.255.255, xrefs: 00103095, 0010309A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: a765e76c65108593f9b172da38d542971061313e017882e5d260b499899ce66d
Instruction ID: 484fb45be502af8dbb6c22af52ab32e12e5e9804927ca21702e321f800448882
Opcode Fuzzy Hash: a765e76c65108593f9b172da38d542971061313e017882e5d260b499899ce66d
Instruction Fuzzy Hash: 84310439200205DFCB14DF28C585EAA77E8EF54318F258059E8A58B7D2CBB2EE41C760

Function 00113EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00113F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00113F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00113F78

Strings

SysMonthCal32, xrefs: 00113F0B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 9fa56edbaf7d40428a1bb48547212d35747220320ace9e30121bfc3ed87067d8
Instruction ID: 799155d369b787fc23bbfefabbe0cab93f912baf53d84d7b2ae6841bced4a648
Opcode Fuzzy Hash: 9fa56edbaf7d40428a1bb48547212d35747220320ace9e30121bfc3ed87067d8
Instruction Fuzzy Hash: 4E219C32600219BFDF299F50DC46FEA3B79EB48724F110224FA157B1D0D7B1A995CBA0

Function 00114653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00114705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00114713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0011471A

Strings

msctls_updown32, xrefs: 00114684

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 9ee066daf2ca7c739c9b604429467d97074752ce0b92902b8c15b2f8abe8bcb5
Instruction ID: a830935f89526871ce0138fd7b4586594bfaa86f3f10d40e6d557b3440634274
Opcode Fuzzy Hash: 9ee066daf2ca7c739c9b604429467d97074752ce0b92902b8c15b2f8abe8bcb5
Instruction Fuzzy Hash: 642160B5600208AFEB15DF64DCC1DE737ADEB5A798B140059FA009B391CB71EC91CB60

Function 000E95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000E961D

Strings

#OnAutoItStartRegister, xrefs: 000E95F3
#requireadmin, xrefs: 000E95D9
#notrayicon, xrefs: 000E95B7

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 413e23e8f6190449a4564219c3215f0f72c5d98b140fc11698707590e241a118
Instruction ID: d530f515b713bec32640d37058dca6c113e2bed6381ad76e100fa7b08a6c5aea
Opcode Fuzzy Hash: 413e23e8f6190449a4564219c3215f0f72c5d98b140fc11698707590e241a118
Instruction Fuzzy Hash: 3A215B72208691AAC731BB269C02FFBB3E8AF91300F10443AF949A7146EB91DD91C395

Function 001137B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00113840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00113850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00113876

Strings

Listbox, xrefs: 0011380F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 6f27aa2431ca6bad5e326c99b674b6f701611e59cb8d60878c1558ba6371af12
Instruction ID: 2d8c24fabd308def753c6e2d372fd1cdab968bea6aa63487b055c61686c559d3
Opcode Fuzzy Hash: 6f27aa2431ca6bad5e326c99b674b6f701611e59cb8d60878c1558ba6371af12
Instruction Fuzzy Hash: 22217C72610218BBEF259F54DC85FEB376AEF89750F118224F9149B194C7719C928BA0

Function 000F49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000F4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 000F4A5C
SetErrorMode.KERNEL32(00000000,?,?,0011CC08), ref: 000F4AD0

Strings

%lu, xrefs: 000F4A6F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: a8219cd20a7a41e0788b9a87d058ea034495151311004723270b4f76fa01cf0a
Instruction ID: 9adc753af89d2108c0ed614f4ad3cea592370b1d6c203770dae8156bb13b7c7b
Opcode Fuzzy Hash: a8219cd20a7a41e0788b9a87d058ea034495151311004723270b4f76fa01cf0a
Instruction Fuzzy Hash: F9316F75A40109AFDB10EF54C985EEA7BF8EF09308F1480A9F909DB252D771ED45CBA1

Function 001141EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0011424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00114264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00114271

Strings

msctls_trackbar32, xrefs: 00114226

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: e7e0313170a119ddd47075035c689160c1ddec97edd022f08243972ddab93533
Instruction ID: ef0a43bd69dbf9a5cc8203b682a2db87df748338a08cd4cd40cb92f73adb8fcf
Opcode Fuzzy Hash: e7e0313170a119ddd47075035c689160c1ddec97edd022f08243972ddab93533
Instruction Fuzzy Hash: D611E031240208BFEF249E28DC06FEB3BACEF95B64F110124FA55E60A0D371DC919B20

Function 000E2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00086B57: _wcslen.LIBCMT ref: 00086B6A

Part of subcall function 000E2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 000E2DC5
Part of subcall function 000E2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 000E2DD6
Part of subcall function 000E2DA7: GetCurrentThreadId.KERNEL32 ref: 000E2DDD
Part of subcall function 000E2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 000E2DE4

GetFocus.USER32 ref: 000E2F78

Part of subcall function 000E2DEE: GetParent.USER32(00000000), ref: 000E2DF9

GetClassNameW.USER32(?,?,00000100), ref: 000E2FC3
EnumChildWindows.USER32(?,000E303B), ref: 000E2FEB

Strings

%s%d, xrefs: 000E2FFF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: c38bebe77346df99db1bae8388bf500a6912ff3b461ea3543795b1d1c4ada787
Instruction ID: 3ec943d7f9772608ae70fd31bd3689d0699d3af639107c2503fbcee63c203736
Opcode Fuzzy Hash: c38bebe77346df99db1bae8388bf500a6912ff3b461ea3543795b1d1c4ada787
Instruction Fuzzy Hash: 4A11B4B56002456FCF547F718C99EEE376AAF94314F048075FA09AB253DF319945CB60

Function 00115882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 001158C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 001158EE
DrawMenuBar.USER32(?), ref: 001158FD

Strings

0, xrefs: 0011588F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 560e663943588227916a66dd88aa57bbc14c45ce1932bbd4101dcc3b55f9eac8
Instruction ID: 039cf17814c501c4a9047d25db4fd5f8eb472e9a9b28a437ebc7d71aa12dd37f
Opcode Fuzzy Hash: 560e663943588227916a66dd88aa57bbc14c45ce1932bbd4101dcc3b55f9eac8
Instruction Fuzzy Hash: 2E016D31600218EFDB659F11DC44BEEBBBAFB85364F1080A9E849D6151EB308AC4EF61

Function 000E007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b6efc1311310f4eb505f066816e4cdc61aeb7766fe4e1ea514d68b2259df53
Instruction ID: 999aa8324fcc0c0f3e06d788f2b75b01cb10d0cb3c9c56a1f7011d3f476dab2f
Opcode Fuzzy Hash: e5b6efc1311310f4eb505f066816e4cdc61aeb7766fe4e1ea514d68b2259df53
Instruction Fuzzy Hash: 40C15C75A00246EFDB14CFA5C898EAEB7B9FF48704F208598E505EB251D771EE81CB90

Function 0010342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00103459
CoUninitialize.OLE32 ref: 00103463
VariantInit.OLEAUT32(?), ref: 0010346E
VariantClear.OLEAUT32(?), ref: 0010371B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: b9b4c18de4e2714b13647f23ca2cf1af6ba59ecc96f179cf93b67f802b0d54e4
Instruction ID: 93da08f01c5340a060cd987fe6f0cbfcd8a30e737ca4784ec94982f74660155f
Opcode Fuzzy Hash: b9b4c18de4e2714b13647f23ca2cf1af6ba59ecc96f179cf93b67f802b0d54e4
Instruction Fuzzy Hash: C4A17E756047009FC704EF28C485A6AB7E9FF88714F14885DF99A9B3A2DB71EE01CB91

Function 000E0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0011FC08,?), ref: 000E05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0011FC08,?), ref: 000E0608
CLSIDFromProgID.OLE32(?,?,00000000,0011CC40,000000FF,?,00000000,00000800,00000000,?,0011FC08,?), ref: 000E062D
_memcmp.LIBVCRUNTIME ref: 000E064E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 17f46159c27634583fbd0db8c971bba5171109f0dc0b34f2915c423bd0d4b218
Instruction ID: f17fdca730cccdb117fb8ca1fc5958fe843ae8f4d65c9b1a2235bf6bf3fc3c74
Opcode Fuzzy Hash: 17f46159c27634583fbd0db8c971bba5171109f0dc0b34f2915c423bd0d4b218
Instruction Fuzzy Hash: 4B810975A00109EFCB04DF94C984EEEB7B9FF89315F204558E516BB250DB71AE46CB60

Function 000C1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000C14C0

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 34b10bdaef1e457774232336cf0d0aff6e6807fef55ad9ae8a396504de7e64dc
Instruction ID: 3fe3ee34646d37df2c77b3d55b9ce1c72a25085c1325200ed960cedb3b4bdf8f
Opcode Fuzzy Hash: 34b10bdaef1e457774232336cf0d0aff6e6807fef55ad9ae8a396504de7e64dc
Instruction Fuzzy Hash: EB413731A40501ABDB297BF88C46FFE3AE5EF43370F24462DF419D6293E634894153A2

Function 00116278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001162E2
ScreenToClient.USER32(?,?), ref: 00116315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00116382

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 5ad0320d8759720fa204df5d7a66872319fec8b96a5fba01d167029f8147e4e2
Instruction ID: 26dd88f289facc83915bcf71b7997a7d800387e597102b7b576adf7cda393fc0
Opcode Fuzzy Hash: 5ad0320d8759720fa204df5d7a66872319fec8b96a5fba01d167029f8147e4e2
Instruction Fuzzy Hash: 30513A74A00209EFCB19DF68D980AEE7BB5FB55364F108169F8699B290D731ED81CB90

Function 00101AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00101AFD
WSAGetLastError.WSOCK32 ref: 00101B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00101B8A
WSAGetLastError.WSOCK32 ref: 00101B94

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 060bbaf68ea8933d6b06dd8348d68046ab4d514c42abf11be5d10bda0862811b
Instruction ID: 449aef950e4f409ac780a691b0e9987cd49da284b45e3a29641b3ae19962892d
Opcode Fuzzy Hash: 060bbaf68ea8933d6b06dd8348d68046ab4d514c42abf11be5d10bda0862811b
Instruction Fuzzy Hash: C441D074600200AFE720AF24C886FA977E5AB44718F54C498FA9A9F7D3D7B6DD418B90

Function 000BB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f48c4e14175a3975d05a94eaadc40ad5f437594441e5ed4280305a720973fb9
Instruction ID: 4a660db280874cf80562f29ffb9957235d32a598463117ec74ee16a2ff42b141
Opcode Fuzzy Hash: 5f48c4e14175a3975d05a94eaadc40ad5f437594441e5ed4280305a720973fb9
Instruction Fuzzy Hash: 5A41E271A40704AFD724AF78CC41BEEBBE9EB89710F10462EF146DB282D7B199018780

Function 000F56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 000F5783
GetLastError.KERNEL32(?,00000000), ref: 000F57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 000F57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 000F57FA

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 9d130c5080be82fa898452b60571b0d91768c7fea8708624a6ac411c96339799
Instruction ID: 3f5b6a3533805ff0501a4cedb20fcbb0e34660f4bb1ca5a63e1c747406f378e3
Opcode Fuzzy Hash: 9d130c5080be82fa898452b60571b0d91768c7fea8708624a6ac411c96339799
Instruction Fuzzy Hash: 3B413C39200A10DFCB10EF15C544A9DBBE1BF89320B18C488E95A6B766CB70FD41DB91

Function 000BD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,000A6D71,00000000,00000000,000A82D9,?,000A82D9,?,00000001,000A6D71,?,00000001,000A82D9,000A82D9), ref: 000BD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 000BD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 000BD9AB
__freea.LIBCMT ref: 000BD9B4

Part of subcall function 000B3820: RtlAllocateHeap.NTDLL(00000000,?,00151444,?,0009FDF5,?,?,0008A976,00000010,00151440,000813FC,?,000813C6,?,00081129), ref: 000B3852

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: d1dc9b048d2d867d426f9bf790853e1df37c4d122e59b1e3722b64d1800f3487
Instruction ID: 7df9f0fdb0ec68c462dfcb96b2fd6458af851fda004e944efeb6dc4138e87eff
Opcode Fuzzy Hash: d1dc9b048d2d867d426f9bf790853e1df37c4d122e59b1e3722b64d1800f3487
Instruction Fuzzy Hash: E031BE72A1020AABDF299F64DC41EEFBBA5EB41310F15416AFC04D7251EB35CD50CB90

Function 001152C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00115352
GetWindowLongW.USER32(?,000000F0), ref: 00115375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00115382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001153A8

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 4a402e12a81f8b8317b91344fc4b90f8914a17a57a6d8e53ba6825967a8fefe9
Instruction ID: 7467c810c3c6c29e12ae28c90c3a906e9104b5d73676b75834947421b22fa1b9
Opcode Fuzzy Hash: 4a402e12a81f8b8317b91344fc4b90f8914a17a57a6d8e53ba6825967a8fefe9
Instruction Fuzzy Hash: 4C31B234A75A08EFEB3C9A14CC05BE83767BB84390F584122FA20972E1C7B099C0EB41

Function 000EAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 000EABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 000EAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 000EAC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 000EACC6

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d5d2766b22a9ba6691f0428d19f5ab3f19395788da682f165d97789aab0636ac
Instruction ID: 421d779f74c1965499e6386b0f00ce3e2880adc1105dc1df669b235980d3f54b
Opcode Fuzzy Hash: d5d2766b22a9ba6691f0428d19f5ab3f19395788da682f165d97789aab0636ac
Instruction Fuzzy Hash: 5D310830B407986FEF35CB668C047FE7BE5AB8E310F28421AE495722D1C375A9858793

Function 00117674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0011769A
GetWindowRect.USER32(?,?), ref: 00117710
PtInRect.USER32(?,?,00118B89), ref: 00117720
MessageBeep.USER32(00000000), ref: 0011778C

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 3e8dffde6532751992ce93648f6b1c2c876a5d6353f4d481617791a24e99bcd5
Instruction ID: a3139dd6ef7d77366983e4942caf4042f85abed0c90644905ca6499f0061e61a
Opcode Fuzzy Hash: 3e8dffde6532751992ce93648f6b1c2c876a5d6353f4d481617791a24e99bcd5
Instruction Fuzzy Hash: 1C417A34A09254EFDB0ACF58C898EE9B7F5BB49314F1581B8E8149B3E1C730A9C1CB90

Function 001116DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 001116EB

Part of subcall function 000E3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 000E3A57
Part of subcall function 000E3A3D: GetCurrentThreadId.KERNEL32 ref: 000E3A5E
Part of subcall function 000E3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,000E25B3), ref: 000E3A65

GetCaretPos.USER32(?), ref: 001116FF
ClientToScreen.USER32(00000000,?), ref: 0011174C
GetForegroundWindow.USER32 ref: 00111752

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: bf2be66805bb8e5c6f54be42935f0724a59236fd4c7c3f066c2171b377560296
Instruction ID: 1f2e36126b6247211c55e41b4efa38592d244435825dacc666059030061f9036
Opcode Fuzzy Hash: bf2be66805bb8e5c6f54be42935f0724a59236fd4c7c3f066c2171b377560296
Instruction Fuzzy Hash: 2C316D71D00149AFDB04EFA9C881CEEBBF9FF48304B5080A9E555E7652D7319E41CBA1

Function 000EDF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00087620: _wcslen.LIBCMT ref: 00087625

_wcslen.LIBCMT ref: 000EDFCB
_wcslen.LIBCMT ref: 000EDFE2
_wcslen.LIBCMT ref: 000EE00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 000EE018

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 4dc84c58cbd75f33d7c5466d2e71896b4463b0edc879bea7ec7ee960b5772e54
Instruction ID: f2761778247ce12b35fee3ad6108cf959213e564f52c1dfe76c9d95d12fc96da
Opcode Fuzzy Hash: 4dc84c58cbd75f33d7c5466d2e71896b4463b0edc879bea7ec7ee960b5772e54
Instruction Fuzzy Hash: 4A21B275900214EFCB20EFA8D981BAEB7F8EF86750F144065E905BB286D7709E41CBA1

Function 000ED4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000ED501
Process32FirstW.KERNEL32(00000000,?), ref: 000ED50F
Process32NextW.KERNEL32(00000000,?), ref: 000ED52F
CloseHandle.KERNEL32(00000000), ref: 000ED5DC

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 763a9081730d708003e9cff86b989aee1dcebaae6a1249f946142d75eabf639d
Instruction ID: eef6d7e203320c469c95b92e98ffa08455a074e593ef483d861acf4b512be5a9
Opcode Fuzzy Hash: 763a9081730d708003e9cff86b989aee1dcebaae6a1249f946142d75eabf639d
Instruction Fuzzy Hash: 8E318F721083419FD304EF54C885ABFBBE8FF99354F54092EF581961A2EB719A48CB92

Function 00118FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00099BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00099BB2

GetCursorPos.USER32(?), ref: 00119001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,000D7711,?,?,?,?,?), ref: 00119016
GetCursorPos.USER32(?), ref: 0011905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,000D7711,?,?,?), ref: 00119094

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b48a6f27aa16a7d55801ef2ca96eaff65bcb74586df871fb0de1a48585d9d3fb
Instruction ID: be5fe8eef463112a7519fa81f094897a77b3e537e12bb1bf404ce09f52b4e7e1
Opcode Fuzzy Hash: b48a6f27aa16a7d55801ef2ca96eaff65bcb74586df871fb0de1a48585d9d3fb
Instruction Fuzzy Hash: 78219F35600118FFCB2ACF94CC68EEA7BB9EB49361F044169F9154B261C3319DD0DBA0

Function 000ED2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0011CB68), ref: 000ED2FB
GetLastError.KERNEL32 ref: 000ED30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 000ED319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0011CB68), ref: 000ED376

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: ccb69007ee9c7a3cbf87499a6e5400898908062269033e79f7bf4260f7726e27
Instruction ID: c1bb94e050386ca2bc58992d8e3292746573b5514dab2c2ec9f3e0ddfa19c669
Opcode Fuzzy Hash: ccb69007ee9c7a3cbf87499a6e5400898908062269033e79f7bf4260f7726e27
Instruction Fuzzy Hash: F0217C745082419F8314EF39C9818AEB7E4EF96364F504A1EF499E72A2DB309A45CB93

Function 000E1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000E1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 000E102A
Part of subcall function 000E1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 000E1036
Part of subcall function 000E1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000E1045
Part of subcall function 000E1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 000E104C
Part of subcall function 000E1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000E1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 000E15BE
_memcmp.LIBVCRUNTIME ref: 000E15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000E1617
HeapFree.KERNEL32(00000000), ref: 000E161E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 99f65bf707261d3d9ca6364230b9fa5771c1ccabd8f65dd93512fd2addeecbfd
Instruction ID: 95d2dd936baafca48772a5f94fcfd66e01f171769b1b1f3e741693d9dc518d44
Opcode Fuzzy Hash: 99f65bf707261d3d9ca6364230b9fa5771c1ccabd8f65dd93512fd2addeecbfd
Instruction Fuzzy Hash: DC216632E41208EFDF04DFA6C949BEEB7F8EF44354F088459E445AB241E770AA45CBA0

Function 00112782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0011280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00112824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00112832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00112840

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 41ff8a7d545323c2dda21e7d22dbba98510eab813cde414418ca7306f0883b13
Instruction ID: 37987e8a1b6753f739d6a158ba166b93dbb6e2402a46ad566715e65c9060a7c7
Opcode Fuzzy Hash: 41ff8a7d545323c2dda21e7d22dbba98510eab813cde414418ca7306f0883b13
Instruction Fuzzy Hash: 4221B331304511AFD7189B24D845FEA7B95AF56324F148168F4268B6E2C771FCD2C7D0

Function 000E78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000E8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,000E790A,?,000000FF,?,000E8754,00000000,?,0000001C,?,?), ref: 000E8D8C
Part of subcall function 000E8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 000E8DB2
Part of subcall function 000E8D7D: lstrcmpiW.KERNEL32(00000000,?,000E790A,?,000000FF,?,000E8754,00000000,?,0000001C,?,?), ref: 000E8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,000E8754,00000000,?,0000001C,?,?,00000000), ref: 000E7923
lstrcpyW.KERNEL32(00000000,?), ref: 000E7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,000E8754,00000000,?,0000001C,?,?,00000000), ref: 000E7984

Strings

cdecl, xrefs: 000E797B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 4cff8a45749041360e3d8e202bfe05d61f39a784f5d710b6cf354fe10ea87e15
Instruction ID: 6d564511b25123ed7c8fe603c3befc8972eaa0d73193d68d2cc5f6ee8a5c7da4
Opcode Fuzzy Hash: 4cff8a45749041360e3d8e202bfe05d61f39a784f5d710b6cf354fe10ea87e15
Instruction Fuzzy Hash: B211E93A204382AFCB155F35DC45EBA77E5FF85350B50802AF94AC7265EF319811D791

Function 00117CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00117D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00117D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00117D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,000FB7AD,00000000), ref: 00117D6B

Part of subcall function 00099BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00099BB2

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 686af664d4f8b4e1bd2add7e97348337fc3429cfe9f8c6db716e20dc692c9cce
Instruction ID: f0954282971474c8fdbf8a8a0c15803451bb0f0fbf6699fd53aff95532023cc1
Opcode Fuzzy Hash: 686af664d4f8b4e1bd2add7e97348337fc3429cfe9f8c6db716e20dc692c9cce
Instruction Fuzzy Hash: 8811CD31204A69AFCF188F68DC04AE63BA5AF45364B118738F839CB2F0D7308990CB80

Function 00115660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 001156BB
_wcslen.LIBCMT ref: 001156CD
_wcslen.LIBCMT ref: 001156D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00115816

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 346c73491e5dd214cb4a86d2a9dd5acf0cd7cb4d974a1e5eba7bcbbac00b65a1
Instruction ID: 1db0cb0933873d90315899c5002d34de2ed8d31341481e42817df987625abdc0
Opcode Fuzzy Hash: 346c73491e5dd214cb4a86d2a9dd5acf0cd7cb4d974a1e5eba7bcbbac00b65a1
Instruction Fuzzy Hash: 3A11B175A00608EADB289FA5CC85AEE77BCAF95764B104036F915D6181F7708AC4CBA0

Function 000B1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1d27f26dde0c2898ddd91c529f78cc3089212743f02299f85c5d28187ea847
Instruction ID: e391b57b72718d98283d3a5b5795a5a49c68c624303b900f6e4660aeac9957a3
Opcode Fuzzy Hash: 2a1d27f26dde0c2898ddd91c529f78cc3089212743f02299f85c5d28187ea847
Instruction Fuzzy Hash: 0501D1B220961A7EF66126B86CD0FEB669DDF417B8F700725F521A11D2DB70CC404170

Function 000E1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 000E1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000E1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000E1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000E1A8A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d094aded5151751a87a9150afa01fcfcbbe451990902dd55f377f9f68e57bb88
Instruction ID: 08f7ca6bf1ee8b4c18bceabfa290c798c3834a5faba77dc8444af1d85002bbda
Opcode Fuzzy Hash: d094aded5151751a87a9150afa01fcfcbbe451990902dd55f377f9f68e57bb88
Instruction Fuzzy Hash: CB113C3AD01219FFEB10DBA5CD85FEDBB78EB04750F2400A1E600B7290D6716E50DB94

Function 000EE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000EE1FD
MessageBoxW.USER32(?,?,?,?), ref: 000EE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 000EE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 000EE24D

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: e155fd7b7ecd74f46da0c0963c1d7a4ac6813d7f1c288696b8d1233e910ca1df
Instruction ID: 7e07670696b3c9d195c2b46c29bb6d193531e573a6e81bb8b3451d6f9af4cb61
Opcode Fuzzy Hash: e155fd7b7ecd74f46da0c0963c1d7a4ac6813d7f1c288696b8d1233e910ca1df
Instruction Fuzzy Hash: 2B110876904298FFC7059FA8DC05BDE7FADAB45321F008219F924E7691D3B0894487A0

Function 000AD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,000ACFF9,00000000,00000004,00000000), ref: 000AD218
GetLastError.KERNEL32 ref: 000AD224
__dosmaperr.LIBCMT ref: 000AD22B
ResumeThread.KERNEL32(00000000), ref: 000AD249

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 2feaddbf513bb0671564270c5056851eca592f08cea0760c061d53bc20867c14
Instruction ID: 58b2706519547cbee9284027c9058ca32c39a150e001d765bcaee953264227b7
Opcode Fuzzy Hash: 2feaddbf513bb0671564270c5056851eca592f08cea0760c061d53bc20867c14
Instruction Fuzzy Hash: EF01D276845204BBDB216BE5DC09BEE7AA9EF93330F10422AF926965D1DF70C941C7A0

Function 00119EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00099BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00099BB2

GetClientRect.USER32(?,?), ref: 00119F31
GetCursorPos.USER32(?), ref: 00119F3B
ScreenToClient.USER32(?,?), ref: 00119F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00119F7A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: c72e4a974dde6b2037a7f2840524ec5d63dd875d21e3c9d5b9d36451b275bed3
Instruction ID: 18006d26deeb25d7c6d9da1e04c0d875e1ae4ea0cc3712481f304815200c8c80
Opcode Fuzzy Hash: c72e4a974dde6b2037a7f2840524ec5d63dd875d21e3c9d5b9d36451b275bed3
Instruction Fuzzy Hash: 1811483290021ABBDB19DF68C9559EE7BB9FB05311F004465F921E7140D330BAC2CBE1

Function 0008600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0008604C
GetStockObject.GDI32(00000011), ref: 00086060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0008606A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 83632e4f33af7053630e4f11f4e2580fce225cfb2478842c066aa1d925adbb19
Instruction ID: cc94e252ef0f3be264d7d9b2d52f10c6db4b343ef6b61310f9b336b2abab968d
Opcode Fuzzy Hash: 83632e4f33af7053630e4f11f4e2580fce225cfb2478842c066aa1d925adbb19
Instruction Fuzzy Hash: 6411AD72101508BFEF265FA48C54EEBBBA9FF083A4F014215FA4452110D733ACA0DFA0

Function 000A3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 000A3B56

Part of subcall function 000A3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 000A3AD2
Part of subcall function 000A3AA3: ___AdjustPointer.LIBCMT ref: 000A3AED

_UnwindNestedFrames.LIBCMT ref: 000A3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 000A3B7C
CallCatchBlock.LIBVCRUNTIME ref: 000A3BA4

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 91ecfecfc21e36ee232e370c2d6aa83d06aca6e489155c421c5c29accb6e02f3
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 97014C32100148BBDF125ED5DC42EEB7FAEEF9A754F044014FE4856122C776E961DBA0

Function 000B3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,000813C6,00000000,00000000,?,000B301A,000813C6,00000000,00000000,00000000,?,000B328B,00000006,FlsSetValue), ref: 000B30A5
GetLastError.KERNEL32(?,000B301A,000813C6,00000000,00000000,00000000,?,000B328B,00000006,FlsSetValue,00122290,FlsSetValue,00000000,00000364,?,000B2E46), ref: 000B30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,000B301A,000813C6,00000000,00000000,00000000,?,000B328B,00000006,FlsSetValue,00122290,FlsSetValue,00000000), ref: 000B30BF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 8b7980602a507e8226039bb99085b14c020cb7449e0e275679f4dc01283112af
Instruction ID: 44f65619ecf4cfa6c79fc1935525ba265bafcf476fd76a9cfc5103cbabca6233
Opcode Fuzzy Hash: 8b7980602a507e8226039bb99085b14c020cb7449e0e275679f4dc01283112af
Instruction Fuzzy Hash: DB01F736765732EBCB319BB8AC54AD77BD8AF05B61B304720F906E7140DB21D941C6E0

Function 000E7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 000E747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 000E7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 000E74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 000E74CA

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 3f33137648c2d820508fa64750b0bab9ef99d55e52b28580ceaaab67af09b4e4
Instruction ID: b3e8a5d2cb1734d15d35c5fec7b402402f7d394cbf05939a61fd3ea4aef406b8
Opcode Fuzzy Hash: 3f33137648c2d820508fa64750b0bab9ef99d55e52b28580ceaaab67af09b4e4
Instruction Fuzzy Hash: 7311ADF5249354AFE7308F15ED08F967BFCEB00B00F108569EA1AEA591D7B0E944DBA0

Function 000EB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,000EACD3,?,00008000), ref: 000EB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,000EACD3,?,00008000), ref: 000EB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,000EACD3,?,00008000), ref: 000EB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,000EACD3,?,00008000), ref: 000EB126

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: adc259fe05289f288596e8ef5066c992a03a900958d148d6113fa9dcfd429968
Instruction ID: 87f04155bcfc5eaac0ab27c60241ada5a5753445cc43d2f2d8e83c76285dd449
Opcode Fuzzy Hash: adc259fe05289f288596e8ef5066c992a03a900958d148d6113fa9dcfd429968
Instruction Fuzzy Hash: BC116D31C4166CEBCF14AFE6E9987EFBB78FF09721F508086D941B2191CB3096909B91

Function 00117E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00117E33
ScreenToClient.USER32(?,?), ref: 00117E4B
ScreenToClient.USER32(?,?), ref: 00117E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00117E8A

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 3a674c703776e379ef36d44ec40ab7bfa9e8a9a36f80c73a8f4454e58020249e
Instruction ID: 1cd14e0b13e3e0668faa72be48631acfff0401e89c76999054b4fdf426c202b9
Opcode Fuzzy Hash: 3a674c703776e379ef36d44ec40ab7bfa9e8a9a36f80c73a8f4454e58020249e
Instruction Fuzzy Hash: 231163B9D0024AAFDB41CF98C9849EEBBF5FB08310F108066E911E2650D734AA94CF90

Function 000E2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 000E2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 000E2DD6
GetCurrentThreadId.KERNEL32 ref: 000E2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 000E2DE4

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 0fc2983e340f94c2ccb0194f31f36f7de3aff458068f5335f28c2b2f0191e8c5
Instruction ID: 1cd38f8dad22ce2b6643de3f435a0fedf3e6f24516916cd75067912afcb2de76
Opcode Fuzzy Hash: 0fc2983e340f94c2ccb0194f31f36f7de3aff458068f5335f28c2b2f0191e8c5
Instruction Fuzzy Hash: 1BE09271585624BBD7241B739D0DFEB3E6CEF42BA1F004115F205E1580DAA0C880C6F0

Function 00118863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00099639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00099693
Part of subcall function 00099639: SelectObject.GDI32(?,00000000), ref: 000996A2
Part of subcall function 00099639: BeginPath.GDI32(?), ref: 000996B9
Part of subcall function 00099639: SelectObject.GDI32(?,00000000), ref: 000996E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00118887
LineTo.GDI32(?,?,?), ref: 00118894
EndPath.GDI32(?), ref: 001188A4
StrokePath.GDI32(?), ref: 001188B2

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: aea8fc5829f6530568d86d943b3079a7354fef190a1180011e2efe5b64246e9b
Instruction ID: 86b4408f4e562b71ee02278c722e89ba5ff91263dd5f21ff1d6aea614a0abd3f
Opcode Fuzzy Hash: aea8fc5829f6530568d86d943b3079a7354fef190a1180011e2efe5b64246e9b
Instruction Fuzzy Hash: 2DF05E3A081268FADB165F94AD0AFCE3F59AF0A311F04C000FA11654E2C7755591DFE9

Function 000998B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 000998CC
SetTextColor.GDI32(?,?), ref: 000998D6
SetBkMode.GDI32(?,00000001), ref: 000998E9
GetStockObject.GDI32(00000005), ref: 000998F1

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 7ec242733a9f16f84ace6790b4c15bbb18dc9b350c46384665e5b20f4ee8e33f
Instruction ID: dc1679623291d85b23a1238ae451b80ea0e97d782462f2910cc76570b6d220fa
Opcode Fuzzy Hash: 7ec242733a9f16f84ace6790b4c15bbb18dc9b350c46384665e5b20f4ee8e33f
Instruction Fuzzy Hash: A8E06D312C4680FADB615B78BD09BE83F61AB52336F14C21AF6FA584E1C37146809B21

Function 000E162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000E1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,000E11D9), ref: 000E163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,000E11D9), ref: 000E1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,000E11D9), ref: 000E164F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 18b1ff37a5d561559ad00b454031a048277c72e97e23d87e0c8abfdeb7e104f1
Instruction ID: 21849698707c04415b66d17053bb72a6cc2299bd3f7d5a5748c2526e9ea469d3
Opcode Fuzzy Hash: 18b1ff37a5d561559ad00b454031a048277c72e97e23d87e0c8abfdeb7e104f1
Instruction Fuzzy Hash: B4E08635641211DFD7601FA19F0DBC73BBDBF54791F14C808F245D9080D6344580C790

Function 000DD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 000DD858
GetDC.USER32(00000000), ref: 000DD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 000DD882
ReleaseDC.USER32(?), ref: 000DD8A3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 195a09a2c0d3e6fe2b01d4981bce95b339f7f2e588422d75c50f5f97862c6ae0
Instruction ID: 191bc65874bf1cb8b7130a3d4cc66149cc4e7df61db3dcb92c889f4a80f131d4
Opcode Fuzzy Hash: 195a09a2c0d3e6fe2b01d4981bce95b339f7f2e588422d75c50f5f97862c6ae0
Instruction Fuzzy Hash: CEE01274844204DFDF559FA0D9086ADBBB1FB08310F10D015F84AE7750C7344541EF90

Function 000DD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 000DD86C
GetDC.USER32(00000000), ref: 000DD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 000DD882
ReleaseDC.USER32(?), ref: 000DD8A3

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 6ec73258389f16895794bdf2085d09741a7c76a008d430f6c11f0a199b512a83
Instruction ID: 96b48c6091784f8997273edd6ea05b3ebb607570efc518a55dfcda5756f7a3b4
Opcode Fuzzy Hash: 6ec73258389f16895794bdf2085d09741a7c76a008d430f6c11f0a199b512a83
Instruction Fuzzy Hash: 34E01A74C44200DFCF54AFA0D9086ADBBB1BB08310B109009F94AE7750C7385941EF90

Function 000F4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00087620: _wcslen.LIBCMT ref: 00087625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 000F4ED4

Strings

LPT, xrefs: 000F4DFB
*, xrefs: 000F4E10

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 988b2990383f1479dc0a98123c105fd37da8d5208a928b7f58fcd13fb0a4c39e
Instruction ID: 6c21d2de99ba1fbb8d9c53611500670a6472da1e07b10a3a909495690f5aad5d
Opcode Fuzzy Hash: 988b2990383f1479dc0a98123c105fd37da8d5208a928b7f58fcd13fb0a4c39e
Instruction Fuzzy Hash: 93918075A002089FCB14DF58C484EBABBF1BF44304F1880A9E94A9F762D771ED89DB90

Function 000AE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 000AE30D

Strings

pow, xrefs: 000AE2E5, 000AE302

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 167651937aebd741eda3c532183f824f4344b261e57d76f6420798173a3c15a8
Instruction ID: 4ab83393c305ccc9b5458be27111285301a70e9470c311522fdbe9612547adf2
Opcode Fuzzy Hash: 167651937aebd741eda3c532183f824f4344b261e57d76f6420798173a3c15a8
Instruction Fuzzy Hash: 08517E61A0C242A6CF757764CD453FD3BE4EF91780F3049A8E0EA462E9EB34CDD19A46

Function 0009E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0009E1B1

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: e694dfdbbd56f929d7643798316d0ed10523dda00d179d6871070af4a2b95304
Instruction ID: 7b29b95912cdaa720285dadfb512e252c7e9d3270ec40bab2644ed113520691d
Opcode Fuzzy Hash: e694dfdbbd56f929d7643798316d0ed10523dda00d179d6871070af4a2b95304
Instruction Fuzzy Hash: 0051E035908386DFDFA5EF68C4816FA7BE4EF65310F244056E8919F391DA309D42DBA0

Function 0009F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0009F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0009F2BB

Strings

@, xrefs: 0009F2AF

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 9a922471337ccee103671f989605c41bc7906c8a2b08734514b9a2ed7e4ba479
Instruction ID: b9abb0f8daeb6515670d6e6c5bb1b05805b7d7ccd276baff7474bf0d25892e5e
Opcode Fuzzy Hash: 9a922471337ccee103671f989605c41bc7906c8a2b08734514b9a2ed7e4ba479
Instruction Fuzzy Hash: D3513871408744ABE320AF10E886BABBBF8FF84314F91885DF1D951196EB318569CB67

Function 00105745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 001057E0
_wcslen.LIBCMT ref: 001057EC

Strings

CALLARGARRAY, xrefs: 001057E6, 001057EB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 68fd24d10c92ad8f3df8d37403e21d990886c604f44b540c122b8b29b444230b
Instruction ID: a48b35611f55deb0ecd4f26e8198751dfec0e40f5d374fb9c9b4b6c0cbed7001
Opcode Fuzzy Hash: 68fd24d10c92ad8f3df8d37403e21d990886c604f44b540c122b8b29b444230b
Instruction Fuzzy Hash: 8641A171A005099FCB04EFA9C8819FEBBB6FF59310F14806AE945A7292E770DD81CF90

Function 000FD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000FD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 000FD13A

Strings

|, xrefs: 000FD10B

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: cf0a51b96bf2d3df7700f2c4a3026c6f2583eeb2622072980247979539541e56
Instruction ID: e480014a94de88d74e3bf7304006b3fba75335bbc9e9526fd8569529a209c09f
Opcode Fuzzy Hash: cf0a51b96bf2d3df7700f2c4a3026c6f2583eeb2622072980247979539541e56
Instruction Fuzzy Hash: 32312F71D00219ABCF15EFA4CC85EEEBFBAFF05310F100019F915A6166EB31AA56DB60

Function 0011356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00113621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0011365C

Strings

static, xrefs: 001135BC

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 2fa27774d01feea9d2a5d0311e2d0a8f16fde9a420e20008773b2ff47ddc2249
Instruction ID: a489a41085e7f4d9e0d02b5a6abd8dda0a252f70d60192cf56975295f4e61174
Opcode Fuzzy Hash: 2fa27774d01feea9d2a5d0311e2d0a8f16fde9a420e20008773b2ff47ddc2249
Instruction Fuzzy Hash: 52319E71110604AEEB189F28DC80FFB73A9FF88764F108629F9A597280DB31AD91D760

Function 00114537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0011461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00114634

Strings

', xrefs: 0011458E

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 09ff31fd69438f6db5617342f781418a6f98825d5001575a34aa605e5e83563b
Instruction ID: ac07e66ce7521dcaa612630edff1727392540d3c808e770755adfef6f8c3bde7
Opcode Fuzzy Hash: 09ff31fd69438f6db5617342f781418a6f98825d5001575a34aa605e5e83563b
Instruction Fuzzy Hash: 46311974A013099FDB58CF69C990BDA7BB6FF49704F14406AE905AB351D770A981CF90

Function 001131EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0011327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00113287

Strings

Combobox, xrefs: 00113249

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 4e82db16e9a94a4fc5ad488f8496db1e47bb41a2f2b270c5c49566b15e3edae2
Instruction ID: a39285a097b2b4d1f6c26492a196deb2544f133d24edcdc52412c5896081516b
Opcode Fuzzy Hash: 4e82db16e9a94a4fc5ad488f8496db1e47bb41a2f2b270c5c49566b15e3edae2
Instruction Fuzzy Hash: E311B2713002087FEF29AE54DC80EFB376BEB983A4F104134F928A7294D7319D918760

Function 00113710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0008600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0008604C
Part of subcall function 0008600E: GetStockObject.GDI32(00000011), ref: 00086060
Part of subcall function 0008600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0008606A

GetWindowRect.USER32(00000000,?), ref: 0011377A
GetSysColor.USER32(00000012), ref: 00113794

Strings

static, xrefs: 00113757

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: f92e35eb9db247ad27139721204243cd001e0b8239230f79eb3c8ede46b9ee79
Instruction ID: ccd1ea53fee7b8278a9f558312c156456eac6b64010191dc2f94d89811f2822f
Opcode Fuzzy Hash: f92e35eb9db247ad27139721204243cd001e0b8239230f79eb3c8ede46b9ee79
Instruction Fuzzy Hash: 34113AB2610209AFDF05DFA8CC45EEA7BB8FB08354F014524F965E2250E735E891DB50

Function 000FCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 000FCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 000FCDA6

Strings

<local>, xrefs: 000FCD66

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 2c8c32ae3437f958ca965610da4bcd25c699111043a4efdbdaf3f8818e180a3e
Instruction ID: 1a41c477dd43beea5dcb25885712bfbf8c6db366bc1804b736d6d6546bf47238
Opcode Fuzzy Hash: 2c8c32ae3437f958ca965610da4bcd25c699111043a4efdbdaf3f8818e180a3e
Instruction Fuzzy Hash: 8411C67124563DBAE7784B668D46EFBBEACEF127A4F004226B20993480D7749841E6F0

Function 00113429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 001134AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 001134BA

Strings

edit, xrefs: 0011348F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: e17a1ec41dbb4f0098c182105258e6dea770c36781ba2f4da61f4b1cb2056780
Instruction ID: 7c13386144f1d8b071ffb6618a35d25fd3b7b2fbd91915d1ed701d59333565ce
Opcode Fuzzy Hash: e17a1ec41dbb4f0098c182105258e6dea770c36781ba2f4da61f4b1cb2056780
Instruction Fuzzy Hash: 3A116D71100208AEEB2A8E64DC44AEB376AEB15374F504324F975975D8C771DCD19B50

Function 000E6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

CharUpperBuffW.USER32(?,?,?), ref: 000E6CB6
_wcslen.LIBCMT ref: 000E6CC2

Strings

STOP, xrefs: 000E6CBC, 000E6CC1

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: f9ce072895ac75253ada4390f03d34b7007c8dc2063091daea921331694a678c
Instruction ID: 397cff829d6ebd7b79b81757d267f11fc8ad296d87fadc5564704a64ff225123
Opcode Fuzzy Hash: f9ce072895ac75253ada4390f03d34b7007c8dc2063091daea921331694a678c
Instruction Fuzzy Hash: C1010832A045668FCB60AFBEEC408BF73E5FB71750B500534E452A2192EB33D800C750

Function 000E1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 000E3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 000E3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 000E1D4C

Strings

ListBox, xrefs: 000E1D16
ComboBox, xrefs: 000E1CEB

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 1bc4e9c6411d688614cfbb0826135221b2f8340be98ce94746262b8d93d8c92b
Instruction ID: e5d4db60d4f326ce6a2a30ac26da8c6b680f97c3bbf61e00eeb7ec61da88333f
Opcode Fuzzy Hash: 1bc4e9c6411d688614cfbb0826135221b2f8340be98ce94746262b8d93d8c92b
Instruction Fuzzy Hash: CD01D471605218AFCB18FBA5CD55CFE77A9FB46360B140619F872773D2EA3199088760

Function 000E1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 000E3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 000E3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 000E1C46

Strings

ListBox, xrefs: 000E1C10
ComboBox, xrefs: 000E1BE5

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 1e89b9eb0785fc1cdb9d1fd8d06ac1056783da0dff6913c19a8bd5a4edb14d8e
Instruction ID: 11e79ef6ebe1817d906c42bf65c5c38e7bbf971a204dd795d9d7205ee7b6b91f
Opcode Fuzzy Hash: 1e89b9eb0785fc1cdb9d1fd8d06ac1056783da0dff6913c19a8bd5a4edb14d8e
Instruction Fuzzy Hash: 3801A7757811486FCB14FB91CA569FF77E9AB11340F240029B456B7283EA319E08C7B1

Function 000E1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 000E3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 000E3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 000E1CC8

Strings

ListBox, xrefs: 000E1C94
ComboBox, xrefs: 000E1C69

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: c61f0fab739fdd1b297f5fb7fd07a6bf5515be8fb272b07037284316be7cd481
Instruction ID: dfda6a0a1b8e108d17012e4deb5e45d7b6f55133d51cb28d7541663d62f7e186
Opcode Fuzzy Hash: c61f0fab739fdd1b297f5fb7fd07a6bf5515be8fb272b07037284316be7cd481
Instruction Fuzzy Hash: 1301D6B16811586FCB14FBA1CA06AFE77E8AB11340F640025B842B3283EA319F08C7B1

Function 000E1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00089CB3: _wcslen.LIBCMT ref: 00089CBD

Part of subcall function 000E3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 000E3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 000E1DD3

Strings

ListBox, xrefs: 000E1DA0
ComboBox, xrefs: 000E1D75

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 30f652442788b3ded3df86afa74b8bc8ee91b543b92f440042ce912c8b108cee
Instruction ID: 77208f193d3f38ed89f6cdac61c469aa92f4b173dc75ee377395747195999469
Opcode Fuzzy Hash: 30f652442788b3ded3df86afa74b8bc8ee91b543b92f440042ce912c8b108cee
Instruction Fuzzy Hash: 43F0A471A452196BDB14F7A5CD56AFE77A8BB01350F580915B862732C3EA71990883A0

Function 0010747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00107493
_wcslen.LIBCMT ref: 001074B9

Strings

3, 3, 16, 1, xrefs: 00107483

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: b6ec06ee6f2c74dc4479e9bfec460898cea604145173846a06564c3998d5c2a6
Instruction ID: 2bf90cfdf8f23cf1bfc029838cdfdc5dbdd0b811c5acc41223a57ef6c239ad19
Opcode Fuzzy Hash: b6ec06ee6f2c74dc4479e9bfec460898cea604145173846a06564c3998d5c2a6
Instruction Fuzzy Hash: 49E02B26A0426010D23116B9ACC19BF968DDFC6750710182BF9C1C22E7EBD49DA193A0

Function 000E0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 000E0B23

Strings

AutoIt, xrefs: 000E0B17
Error allocating memory., xrefs: 000E0B1C

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 10644e658965a48e1455403b84949a82c036e05f5127f0184e67a8547a8d586c
Instruction ID: 6207e0424804aefc1e13e510199abdb1f90cdacbff3bb9ffd9ef69cadb3059a4
Opcode Fuzzy Hash: 10644e658965a48e1455403b84949a82c036e05f5127f0184e67a8547a8d586c
Instruction Fuzzy Hash: 8AE0D8312883082BD21436947C03FC97A859F06F14F100426F788A54C38BE224D056E9

Function 000A0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0009F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,000A0D71,?,?,?,0008100A), ref: 0009F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0008100A), ref: 000A0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0008100A), ref: 000A0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000A0D7F

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 45133b737023e02ab68895a52beea8e8130fdcdfb74eb9bd0f870871c9ca6daa
Instruction ID: 8d19c4d0cb2e44ba9cafe8b68f8c0ad8db83285664be41bc49a4135287814cad
Opcode Fuzzy Hash: 45133b737023e02ab68895a52beea8e8130fdcdfb74eb9bd0f870871c9ca6daa
Instruction Fuzzy Hash: FEE092742007018BD3749FF8D508392BBE0BF01740F00893DE486C6A52DBF5E4888BD1

Function 000F3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 000F302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 000F3044

Strings

aut, xrefs: 000F3038

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: ef252ff9806acb63aa4b077433e3e407152b591401fff5ca77937fadb1274cc4
Instruction ID: 60cb1e04578e22924a82af42b0b01fc4129534cd38a3b0df4bff2f42de4caa1b
Opcode Fuzzy Hash: ef252ff9806acb63aa4b077433e3e407152b591401fff5ca77937fadb1274cc4
Instruction Fuzzy Hash: 3ED05EB254032867DA20A7A4AD0EFCB7A7CDB05750F0002A1B655E20A1DAF09984CAD0

Function 000DD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 000DD220

Strings

%.3d, xrefs: 000DD22B
X64, xrefs: 000DD2A8

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 9181bfae30ddaedffd7761d4001fb7a1167834894dfb76bbbfe59e9c809cc0d6
Instruction ID: 37b4158799b5edfdde55e007b04a2dec4aceb3e6281377fd157ca4db016764bd
Opcode Fuzzy Hash: 9181bfae30ddaedffd7761d4001fb7a1167834894dfb76bbbfe59e9c809cc0d6
Instruction Fuzzy Hash: E2D012A1848209EACF609AD0CC459FDB37CBB38341F508453F806D1140D734C5486B71

Function 00112322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0011232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0011233F

Part of subcall function 000EE97B: Sleep.KERNELBASE ref: 000EE9F3

Strings

Shell_TrayWnd, xrefs: 00112325

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: fb202b997696a87a52763e68315d465a19846208d01700116989dd7b1f1329cd
Instruction ID: 71ef276bf028282b48abb996e0253cc18e1c89790924c1d3388f66613a04a24b
Opcode Fuzzy Hash: fb202b997696a87a52763e68315d465a19846208d01700116989dd7b1f1329cd
Instruction Fuzzy Hash: 0DD022323D0350BBE2A8B370DC0FFC6BA049B00B00F0089027305AA1E1D9F0A880CA80

Function 00112356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0011236C
PostMessageW.USER32(00000000), ref: 00112373

Part of subcall function 000EE97B: Sleep.KERNELBASE ref: 000EE9F3

Strings

Shell_TrayWnd, xrefs: 00112365

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 9fce0d1bbc2e23582aabfd11ccf29c2fa108fcaf2b59961604e28c76dd8b2054
Instruction ID: 16c12882d559f9349f07f3fc9580e1d91f50561fcff6981d2bd97669c6591f18
Opcode Fuzzy Hash: 9fce0d1bbc2e23582aabfd11ccf29c2fa108fcaf2b59961604e28c76dd8b2054
Instruction Fuzzy Hash: F4D022323C03507FE2A8B370DC0FFC6B6049B00B00F0089027301EA1E1D9F0B880CA84

Function 000BBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 000BBE93
GetLastError.KERNEL32 ref: 000BBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 000BBEFC

Memory Dump Source

Source File: 00000000.00000002.2892251219.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2892224093.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892314032.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892367423.000000000014C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892391349.0000000000154000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: b14db334adbe22eb6e71b148d067eacd8fd39a798ab6c9bdc08e2d5c307cf688
Instruction ID: ac9c38bb1a11a57f8e10ce613858554e12da62ca9c996bdc022739121166fd5d
Opcode Fuzzy Hash: b14db334adbe22eb6e71b148d067eacd8fd39a798ab6c9bdc08e2d5c307cf688
Instruction Fuzzy Hash: 4141C134604207AFCF758FA4CC44AFA7BE5AF52320F144169F9699B1A1EBB08D01CB60

Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.67 13.107.246.67
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97

Source: global traffic	HTTP traffic detected: GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=-7651382275432408937&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1Host: arc.msn.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725604516&P2=404&P3=2&P4=jbFRwzq7cEH98vOU3Gor4VB3laJFARUSUxarVuoPE0ux4jQrGLpL5WzZDu%2fIhmUG%2bBawl3Xkn7PbpumjDTY2LQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 9a7cw9emBvA17vBlU8Bzb9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=-7651382275432408937&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1Host: arc.msn.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Knzu5llsVTOxzou&MD=cf25Gyt1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725604516&P2=404&P3=2&P4=jbFRwzq7cEH98vOU3Gor4VB3laJFARUSUxarVuoPE0ux4jQrGLpL5WzZDu%2fIhmUG%2bBawl3Xkn7PbpumjDTY2LQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 9a7cw9emBvA17vBlU8Bzb9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Knzu5llsVTOxzou&MD=cf25Gyt1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1ecea392-9254-4850-826f-a35309cbad73.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2d34c4f9-998d-4f47-a31c-2157442a7ad0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7614c980-b8bc-4d31-a0fa-e71624fe10d6.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7695edec-25f4-4204-89f2-6de617bd107c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7a1c9612-978c-4d96-bc1c-44face983a86.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\982be20e-40e6-435b-8c5d-df1d848871a1.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\9e7a87d0-d098-4094-9e27-ea55a8b7e9b9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\a2d2b249-a8ae-4cea-919e-9f1ea42a8793.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D1680E-1AA0.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D1680F-1520.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0594febd-14c1-41d4-8e35-c3664fcfb41c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3d2402c2-b979-46b4-9408-0bd2c5111e8f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\44cceb5f-2947-48f2-b213-473610770b7a.tmp

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre