Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502193
MD5:	29517e92d7761860f63fc179b031172d
SHA1:	fee8246f3841238774132287ff9645fd240da0ce
SHA256:	c480a41460d45f0d11873a8b273b4193a270d3a4ed28c5653b566fc8ea06b680
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7500 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 29517E92D7761860F63FC179B031172D)

msedge.exe (PID: 7516 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1912,i,14927301562858927036,17486074749245715657,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7760 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8028 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6964 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8824 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6924 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8908 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7264 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8928 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7264 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8620 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7776 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9108 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4380 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 2172 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5936 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8312 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5936 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 4628 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 932 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2136,i,8358726589988905898,12135449395727678176,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6712 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8320 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2012,i,16325592486181929510,8706679362806324628,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6764 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7584 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2000,i,18419734026850223722,7640752483822998294,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 326Content-Type: text/html; charset=us-asciiDate: Sat, 31 Aug 2024 12:28:00 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.65a13617.1725107280.d415d85Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: *Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin: *

Source: file.exe, 00000000.00000002.2902987792.0000000001102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.12.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.12.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.12.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: ed8e092f-b73e-45e5-bb3b-03a08870fcb8.tmp.13.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.12.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ed8e092f-b73e-45e5-bb3b-03a08870fcb8.tmp.13.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.12.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: content.js.12.dr, content_new.js.12.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ed8e092f-b73e-45e5-bb3b-03a08870fcb8.tmp.13.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 59269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59271
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59270
Source: unknown	Network traffic detected: HTTP traffic on port 59271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59272
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 59270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 59267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 59266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59268
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59267
Source: unknown	Network traffic detected: HTTP traffic on port 59276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59266
Source: unknown	Network traffic detected: HTTP traffic on port 59272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:59276 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FDEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00FDEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FDED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00FDED6A

Source: C:\Users\user\Desktop\file.exe

0_2_00FDEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FCAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00FCAA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FF9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00FF9576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1651182372.0000000001022000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e5dbd62c-9
Source: file.exe, 00000000.00000000.1651182372.0000000001022000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_28df9cde-5
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_06ff8a7e-8
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_cc4c624b-8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FCD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00FCD5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00FC1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FCE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00FCE8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F68060	0_2_00F68060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD2046	0_2_00FD2046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC8298	0_2_00FC8298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F9E4FF	0_2_00F9E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F9676B	0_2_00F9676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF4873	0_2_00FF4873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6CAF0	0_2_00F6CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8CAA0	0_2_00F8CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7CC39	0_2_00F7CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F96DD9	0_2_00F96DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F691C0	0_2_00F691C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7B119	0_2_00F7B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F81394	0_2_00F81394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F81706	0_2_00F81706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8781B	0_2_00F8781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F819B0	0_2_00F819B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7997D	0_2_00F7997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F67920	0_2_00F67920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F87A4A	0_2_00F87A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB3CE7	0_2_00FB3CE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F87CA7	0_2_00F87CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F81C77	0_2_00F81C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F99EEE	0_2_00F99EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEBE44	0_2_00FEBE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F81F32	0_2_00F81F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F7F9F2 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F80A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@96/523@20/12

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD37B5 GetLastError,FormatMessageW,

0_2_00FD37B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC10BF AdjustTokenPrivileges,CloseHandle,		0_2_00FC10BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00FC16C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00FD51CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FEA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00FEA67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00FD648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F642A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00F642A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\5cd1445a-fcf3-4b90-b14e-65c2117b4018.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.12.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1912,i,14927301562858927036,17486074749245715657,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6964 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6924 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7264 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7264 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4380 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5936 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5936 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2136,i,8358726589988905898,12135449395727678176,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2012,i,16325592486181929510,8706679362806324628,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2000,i,18419734026850223722,7640752483822998294,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1912,i,14927301562858927036,17486074749245715657,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6964 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6924 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7264 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7264 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4380 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5936 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5936 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2136,i,8358726589988905898,12135449395727678176,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2012,i,16325592486181929510,8706679362806324628,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2000,i,18419734026850223722,7640752483822998294,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F642DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F80A76 push ecx; ret

0_2_00F80A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00F7F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00FF1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-96667

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6454

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.4 %

Source: C:\Users\user\Desktop\file.exe TID: 7504

Thread sleep time: -64540s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6454 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FCDBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD68EE FindFirstFileW,FindClose,	0_2_00FD68EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00FD698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FCD076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FCD3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FD9642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FD979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00FD9B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00FD5C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F642DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-96316

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FDEAA2 BlockInput,

0_2_00FDEAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F92622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F92622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F642DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F84CE8 mov eax, dword ptr fs:[00000030h]

0_2_00F84CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00FC0B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F92622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F92622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F8083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F809D5 SetUnhandledExceptionFilter,	0_2_00F809D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F80C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00F80C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00FC1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FA2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00FA2BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FCB226 SendInput,keybd_event,

0_2_00FCB226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FE22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00FE22DA

Source: C:\Users\user\Desktop\file.exe

0_2_00FC0B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00FC1663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F80698 cpuid

0_2_00F80698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00FD8195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FBD27A GetUserNameW,

0_2_00FBD27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F9BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00F9BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F642DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00FE1204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00FE1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	22%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Virustotal		Browse
https://msn.com	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://www.office.com/Office	0%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Virustotal		Browse
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Virustotal		Browse
https://docs.google.com/	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.186.129	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content.js.12.dr, content_new.js.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	ed8e092f-b73e-45e5-bb3b-03a08870fcb8.tmp.13.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.54.161.105	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.65.238	unknown	United States	15169	GOOGLEUS	false
142.250.80.4	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.65.174	unknown	United States	15169	GOOGLEUS	false
142.250.64.67	unknown	United States	15169	GOOGLEUS	false
142.250.186.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502193
Start date and time:	2024-08-31 14:26:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@96/523@20/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 41 Number of non-executed functions: 311
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 204.79.197.239, 13.107.21.239, 13.107.42.16, 13.107.6.158, 64.233.166.84, 2.19.126.152, 2.19.126.145, 142.250.185.227, 142.250.185.195, 2.23.209.130, 2.23.209.140, 2.23.209.182, 2.23.209.186, 2.23.209.183, 2.23.209.191, 2.23.209.189, 2.23.209.135, 2.23.209.133, 199.232.214.172, 192.229.221.95, 142.250.184.206, 142.250.185.138, 142.250.185.170, 142.250.74.202, 142.250.185.106, 142.250.185.202, 142.250.186.74, 216.58.212.170, 142.250.184.234, 142.250.186.106, 142.250.185.74, 142.250.181.234, 142.250.186.170, 172.217.18.10, 142.250.186.42, 172.217.16.138, 142.250.185.234, 142.250.80.99, 142.250.65.227, 142.251.40.227, 142.250.65.195, 142.250.80.67, 20.75.60.91, 142.251.40.131
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, dns.msftncsi.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, iris-de-prod-azsc-v2-eus2-b.eastus2.cloudapp.azure.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.az
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:27:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
13:27:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
13:27:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
13:27:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://security-azure.b-cdn.net/	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://login.ap-financier.com/TaqWmoGv	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://spo.devgdmsuk.com/authorize	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
chrome.cloudflare-dns.com	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	play.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	BankPaymAdviceVend.Report.docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	188.114.96.3
	https://emp.eduyield.com/el?aid=28gedda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/innhanhanhsang.com.vn/.dev/RgZNq3Jz/a2ltLmZvcmRAcmF2ZWlzLmNvbQ==$%C3%A3%E2%82%AC	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	dmhu7oz5yP.exe	Get hash	malicious	DCRat	Browse	188.114.97.3
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9
	file.exe	Get hash	malicious	Unknown	Browse	23.55.235.170
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	https://xjp.steamproxy.vip/profiles/76561199276106401	Get hash	malicious	Unknown	Browse	2.16.241.11
	https://xjp.steamproxy.vip/id/sircapthe4th	Get hash	malicious	Unknown	Browse	2.16.238.136
	https://emp.eduyield.com/el?aid=28gedda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/trinitybiblechurch.za.org/.css/9gKijWfa/ZGhvcm5lQGFkdmVudGhwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	172.233.33.245
MICROSOFT-CORP-MSN-AS-BLOCKUS	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	13.107.21.239
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	SecuriteInfo.com.Linux.Siggen.9999.15938.22369.elf	Get hash	malicious	Mirai	Browse	20.65.255.2
	SecuriteInfo.com.Linux.Siggen.9999.6222.10653.elf	Get hash	malicious	Mirai	Browse	20.110.97.184
	SecuriteInfo.com.Linux.Siggen.9999.28313.2324.elf	Get hash	malicious	Mirai	Browse	20.54.143.248
	SecuriteInfo.com.Linux.Siggen.9999.29618.24208.elf	Get hash	malicious	Mirai	Browse	40.96.151.201
EDGECASTUS	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://security-azure.b-cdn.net/	Get hash	malicious	Unknown	Browse	152.199.21.175
	http://www.kraftpaints.ro/eve/pdfonline-3d2-new-bg2/pdfonline-3d2-new.bg2/pdfonline-3d2-newbg2/index.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://grand-pika-f642c4.netlify.app/#mthatha@africawsp.co.za	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://emp.eduyield.com/el?aid=28gedda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/thaiphong.com.vn/.dev/4vGsuwWa/ZGFubnkubXdpc2VuZXphQGluaGFiaXQuY29t$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.486378899006976
Encrypted:	false
SSDEEP:	96:0q8NkGS1f1q2w58rh/cI9URoDotoltBR3v/xFdgnJkRcBSDS4S4SDSJDI4a:/8NBSvq2JeoDUKj/gJkRM
MD5:	2AB392633C9756366ADBD8032453B0F7
SHA1:	E5DEFD0B11D2B85D918CD3C74009F9C9D3039DEF
SHA-256:	611174C0862BABF223D1CE14AA18E825A6F2ED6F093E4D8174AF0C73D4C4F138
SHA-512:	DA8A3696734C3570E533368591A26768D1C81FBA0C8CD985399A8D9E49D9C0C7326E6F0A22E76E578ECC572244176A0EA95B5ABDCA31BE1ED10C1965D3680ABC
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVY

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\169626ad-7c64-428e-8792-b53465606e40.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.580034126025458
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0af19Ri2wzkHB+Idrx1vBJxFunRx3aJkXBciwlRThHB0:Xq8NkC1f1q2wCBR3v/xFCxKJkRcH1Hq
MD5:	F8C8A6FEE47A163B634BA3C54719BE05
SHA1:	F3E6B7234B7CFD4BE50DDDA124EEB7141F15A141
SHA-256:	91BEABB785347C7D75344C8623B0AE5B30B30EB286FE1EB1CFC02AC4C8B09E1B
SHA-512:	BBC3BE3139EC161D3004717ED6CFF1BCF739D0F80EEB9E109858B6183366ADB7944076EF3324287254B7880CB74A5AC4D6F7FEB5DDDC4A6D6B841DCDA536BF44
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"policy":{"last_statistics_update":"13369580815204870"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1dc2b5b4-d167-4c11-a6d0-51e6becd1cca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24341
Entropy (8bit):	6.055148807594636
Encrypted:	false
SSDEEP:	384:xtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NGVahnQbJ4qdqVE/zC9IrIXV1PdQYT3WZ:rMGQ7FCYXGIgtDAWtJ4nralQb5/zC9I/
MD5:	6AFD2D33441A9C4EAF8F82BC7FE15C8B
SHA1:	602F40A4990B0328DD710ABEFC69C828281FEB8A
SHA-256:	9D35300ACB2AA8BCE0B58753FBB8F374FB6E527A83F698E1FDB8634550B5FB3C
SHA-512:	520E5D5CFD8021B57D9D1CB4B81427600E29B0AEF5CD4366D3B9C0A9280A011DA8D0E0C5F9A258ECFC8C3034703ED12EA376B7EFE8D44B689B5EBD28CFBD9AE1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369580817315423","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2114ba7f-f349-4cf0-83d2-c2f01fadac9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.064918676057708
Encrypted:	false
SSDEEP:	384:xtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSVamnkRaRiV1PdQYT3W4Ad4n5A:rMGQ7FCYXGIgtDAWtJ4nZa4kRaRiV11a
MD5:	04CBD680F81F3F527352E4B7A0669550
SHA1:	285F04955836EBF1A20B3FAF30E70EA764853596
SHA-256:	9DA2D4A44B3536C758383604FAD03BA1C2CBE97D8DB08FF95FB81DADDFA68F3E
SHA-512:	B5AA39D0AF206D58A9E746160AB4A07AA274DD48F6C26D895E6E8941FF838E61BEC868625F21BDD1D670323FE3013434D133487A44611CF402AC2E6BCDC18AD9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369580817315423","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\37461391-635f-4d92-aca0-bffdfcf49bee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71078
Entropy (8bit):	6.0727996358034035
Encrypted:	false
SSDEEP:	1536:rMGQ5XMBGTPQ0vAxZtMdMFsLVkI38UCU95Y1JlnIHeXxJ+R/zLrIa11b2:rMrJM8TdvAxLM+e38U3S1AZ/zLrIa11a
MD5:	934DE1499D473D16AF549B92DD0410A7
SHA1:	039779AAAA80D33434399D2EA8EB3F4F32D43B10
SHA-256:	80734EB9A97E72F5F8C75454D3D663745090474A3565EB44A4F9D15BBEB93155
SHA-512:	FF628F48A9E269811FA194B90E8E11CCE6391B0C9A3EFC66155F4E430C4D6F45BA89304F574650B8A128FD7D8478586C402BF236506B04D3BDC2A7D9A33BBDF3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369580817315423","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3a8b4752-ace6-4898-9c3a-fb732c993faa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6e6e003c-3695-436c-b89b-f80e4935f29d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71039
Entropy (8bit):	6.072725334331172
Encrypted:	false
SSDEEP:	1536:rMGQ5XMBG2PQ0vAxZtMdMFsLVkI38UCU95Y1JlnIHeXxJ+R/zLrIa11b2:rMrJM82dvAxLM+e38U3S1AZ/zLrIa11a
MD5:	A344CC4914A4D6492F194EDAB4666C83
SHA1:	5673922E834D3FEB3FA09C1E1B7DE0311DE93194
SHA-256:	D675EC2885C9BE72257A28E90E48B75E5A1679722C316F0A917AC8AC3B598E32
SHA-512:	C6812D429D6EFF95082D2BA44927E8C85C7693D154E21624A914D8A5D2F5382BAABAD3865B31AA74E1D58C5DB908694BF89E381D15FDF371F8177FA788DAC24E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369580817315423","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7332da02-21a0-415e-bf3d-8bb68dc0804a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.5992235999785445
Encrypted:	false
SSDEEP:	96:0q8NkC1f1q2wk7BR3v/xFdgnJkRcBSDS4S4SDSJDI4a:/8Nbvq2Pj/gJkRM
MD5:	E6591A2E469F2B0288EDA619A24A3062
SHA1:	59C842F24484D88003F855259A9DB75AC1302C81
SHA-256:	2B54A01D92C1F241184CA9C879FA6AE2CA788D1C3B5977F194F8A357FDA09AAA
SHA-512:	D85A2511D8A8EEDAB8A1B01067E770BA71B2AA016CF8C25851C79CC2AB39D77989E37E39FCA08756199654E509FCA07F302DF674B7001365D0C01B39A4BDE904
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\53a3515f-ed50-4b7a-83d7-c501d85cc5d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D30C0F-1D5C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04049195891254949
Encrypted:	false
SSDEEP:	192:sOUjLYiVWK+ggCdPbJtD+1X9XYj9oUguELUhZvNEfbcRQM9FeRn8y08Tcm2RGOdB:1UjjlB6+juYhFuQXeR08T2RGOD
MD5:	27009AFA19C99321F36F79C10BD4120E
SHA1:	E19C952FD092A3FC0B12E4D199DAD7DA8374F3B3
SHA-256:	D8A094998722A20FA37EF3FCB9289048A0C564ADB70C7E1A0775B01E8ED945E1
SHA-512:	6A87FB62F3BC277B8E27F01676A116E3DF85D67944ACE0161AB0F5AD46E63B0747A9824FD9942AA128250B921BAA5DE0E375BB3A9BE89898A95C808E4FDA8A4E
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".dhficx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............8..................5..$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z.....Q..-U@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D30C0F-1E50.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4574396275349017
Encrypted:	false
SSDEEP:	3072:SNEM5sgLVnmgB3yy6uGIMd4+LUbjfOEEtx4nhhg1HFnQ4zQCJlEBpqD2MMevYyvN:oGgiQFnhhaHVZG/BwiraHjDnt5N
MD5:	F0581E94B83D828E619EFB611213350F
SHA1:	A192F70B1655E5A7738439F0761FCBDB5CA65D48
SHA-256:	50C0DE817042F60B930A2EE8651E67F9C07A8783958F27C60F7932AA99894CF1
SHA-512:	F57EA6FC452CAD63BAB3A90650BD83B9B75CE0A55E358AD4E50AD4E307AC7FB7AFF45355D1D98FCB21AC6C1A8AC0F6736EADBA86C0E7C0381A70CE6DDAB48760
Malicious:	false
Preview:	...@..@...@.....C.].....@................T...T..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".dhficx20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.160498086267536
Encrypted:	false
SSDEEP:	3:FiWWltlowOKIiHSRqOFhJXI2EyBl+BVP/Sh/JzvDf7BGYmn1x9lkl:o1tOFiyRqsx+BVsJD38Fx96
MD5:	7FD4983E38C1B045932C078C8B40D558
SHA1:	AC0F8594E74E825478181514970AB54B6E020BB5
SHA-256:	D2703444C2B096CD3B08890B8BE21DCE224A641F03EAB5511455C1F7300D409B
SHA-512:	5E9361772E067C3FBBD027E223704BBECF88C1635D05FB8EDEB75740AB4AF20848D25147F7EBC6F1B6F5F9E80D3048FA7A4AD4B9DAB6EEADACFF630CBABE45D1
Malicious:	false
Preview:	sdPC..........................L...Ds..."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................91cfc04d-e2c0-42c2-9248-a38aaab43a80............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0c2be940-2d42-4863-9b44-0e258f174e91.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7a4b2fc4-a152-4e52-b628-050c07dc76e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.978020786918808
Encrypted:	false
SSDEEP:	96:stkqfois14b9x9eN8zGPs85eh6Cb7/x+6MhmuecmAeLxQU2MM/EJ:stkOseeNkKs88bV+FiAoPMMJ
MD5:	9C948D259FAF6EE0A6DBECB8FE46CD02
SHA1:	E7CACEAE83BB6DD41FF591817F332667699879E8
SHA-256:	3D7F191C5ECDE64D141AFA8A1DB58446745BB9928D0D120E3BFDC66217212D64
SHA-512:	412777A4052DE49531098CBA67BBEF16F2D9F0ED19CF56E6C7C994CB12340A6E6CB4D37BBFC75D45C708DCE4066016B94F00A45FA7634EF4EFF2105A6E9B5702
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369580816942153","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369580816960827"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\97a02e9e-e246-4727-a42e-e8eb4a144dd8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321064831307781
Encrypted:	false
SSDEEP:	192:eAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:hOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	09DE20BE35CB03069DC2522E10E4A368
SHA1:	FE4E47282CD3518FAD27CC3DE16000E1DEEA726E
SHA-256:	891B3283CE7E45863152AA5D6D8DA85C2A87829F9DFA7D3879107E7D3D75BD48
SHA-512:	E56B84791E6AAD8A7144F001F903430FC31A1650D12CB501E40B6613F1F61B12CB877433775C3039C3A194DBD1EBFAC5F429C3CFBC4BC4291C71464D209C9691
Malicious:	false
Preview:	...m.................DB_VERSION.1.%.~.................QUERY_TIMESTAMP:arbitration_priority_list4...13369580821649285.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.129312883311614
Encrypted:	false
SSDEEP:	6:us/IsR1wkn23oH+TcwtOEh1ZB2KLlEs/Oh+q2Pwkn23oH+TcwtOEh1tIFUv:dwTfYebOEh1ZFLlJvYfYebOEh16FUv
MD5:	A18AC0C5A9292C7D23B59F286B814C31
SHA1:	B5A02D50F8FE50E94A8377935F9E326D43CCD59A
SHA-256:	0DCFB498D31F5823B14363717CD5589A3D5839C43311E0C674EAF98A1B962325
SHA-512:	74CA5F9EDAF4B314C6899B3AE27A83A8F99005B4440F7D80878628D3F5BE17BD9E379C5320A6D95FC3943161386A3B357F5975FB125CDB9DB94C5F879BA3017D
Malicious:	false
Preview:	2024/08/31-08:27:00.908 2298 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/31-08:27:00.963 2298 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04379032454762152
Encrypted:	false
SSDEEP:	6:/Fii2QkxUkM/lXHRc2aCudtsfRllg/RB+H/l:dcEuZF/s5/MON
MD5:	8D7747F484B471E0271E5B60FFE64387
SHA1:	875E069EE0E0CD93BB182B7752695CE7065827E7
SHA-256:	7C31F01DA32E811B2854A2746D2F642B4D76DDD6EF9CB55775284478861DA879
SHA-512:	B0BB8874B478602CABA2450A09CBB332223705EEB1CBBCB148E742A2683431CBB74467D42D7DEF9F665951A5475AB8DB01DEB0BBED61B7BE1D5C06504ACB9D1E
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09573195360627197
Encrypted:	false
SSDEEP:	48:cQV4XesTKV4A3es3NUeGtArhTNT3lWp4:lV4X3+V4A333NLGtAtTB3L
MD5:	3F1353C2D567F91E1E5ED2CF9940597C
SHA1:	6FEAD0E08E4FE02A83D07DB42E7072361F359462
SHA-256:	CBF29B820CD4997B4A190110534CC5052FEA2AC4BFF84060FF08F4A420FC92CF
SHA-512:	EF011D0628533976F3A7C334028F589B0A3AAF3643E4237E332061B998F3321BE4263D21D843791933604F062E63841F95ECEB0213AB813B2470025650EB4273
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.28326565844853296
Encrypted:	false
SSDEEP:	384:0rxUJtnzrxUJtnRPAJtbSAJtbAUhJtbl:ueJtXeJteJtFJtdJt
MD5:	BFFCE6E85070FDD465D500E5C6B4DD15
SHA1:	6DAE870CF239895659BA4B75C4E7CAF1A5268EEB
SHA-256:	D3C3FE277ECA256AC77EC9D5D448613CE1E2677970E6D0E80E8C3D1DDE0F2443
SHA-512:	8139504ADFF82F0BBD91A31003B5554F0DD12D42204E628604406DB25B85214ADBDF6CE682297BE37C0BF6816D98D3A9B11459C93DF176CBD4BFA54FC8D08BE9
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsuldBX:Lsw
MD5:	00EEF7E0FD416A5D904E3AB9952F1A8C
SHA1:	E4D64FBFE05A0542F2E7A07465AFC6E632677123
SHA-256:	2A82E191E14AF6BD91EE7ED3E7AA3748F9F02E8452A787AF2571CC8B5194A4ED
SHA-512:	2734611256426DBE7926058A13FA1B0F26BC7E5F8F2C99926F0EC36A78135E2586D5BAD4867A0C9FBC9E74311FF254900B5C47EA7BABD0B8152A83445C5C5AB5
Malicious:	false
Preview:	.........................................K].../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9138909867280645
Encrypted:	false
SSDEEP:	3:DwSKcFjECkf:sSK0wf
MD5:	CC78BAFA2062F1A0FDA14A66CF75030A
SHA1:	AF41E051DA729D1DDD73CF9352988B72F8649800
SHA-256:	023A8A3B95ADF41CF21901B43C13FD2C0D6FDEA7D74E2E004D3C37F24B8E69E7
SHA-512:	BE05F5A15A134BF21535E91B705B3657D5EA571C84E57848CAB3C50D107FEBF7738D91701793FFEC87BDB370AAB1C0A22C3E7B22AFAC39875B4AC7E9FF00097D
Malicious:	false
Preview:	(.....t.oy retne..........................S.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9138909867280645
Encrypted:	false
SSDEEP:	3:DwSKcFjECkf:sSK0wf
MD5:	CC78BAFA2062F1A0FDA14A66CF75030A
SHA1:	AF41E051DA729D1DDD73CF9352988B72F8649800
SHA-256:	023A8A3B95ADF41CF21901B43C13FD2C0D6FDEA7D74E2E004D3C37F24B8E69E7
SHA-512:	BE05F5A15A134BF21535E91B705B3657D5EA571C84E57848CAB3C50D107FEBF7738D91701793FFEC87BDB370AAB1C0A22C3E7B22AFAC39875B4AC7E9FF00097D
Malicious:	false
Preview:	(.....t.oy retne..........................S.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9138909867280645
Encrypted:	false
SSDEEP:	3:DwSKcFjECkf:sSK0wf
MD5:	CC78BAFA2062F1A0FDA14A66CF75030A
SHA1:	AF41E051DA729D1DDD73CF9352988B72F8649800
SHA-256:	023A8A3B95ADF41CF21901B43C13FD2C0D6FDEA7D74E2E004D3C37F24B8E69E7
SHA-512:	BE05F5A15A134BF21535E91B705B3657D5EA571C84E57848CAB3C50D107FEBF7738D91701793FFEC87BDB370AAB1C0A22C3E7B22AFAC39875B4AC7E9FF00097D
Malicious:	false
Preview:	(.....t.oy retne..........................S.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9138909867280645
Encrypted:	false
SSDEEP:	3:DwSKcFjECkf:sSK0wf
MD5:	CC78BAFA2062F1A0FDA14A66CF75030A
SHA1:	AF41E051DA729D1DDD73CF9352988B72F8649800
SHA-256:	023A8A3B95ADF41CF21901B43C13FD2C0D6FDEA7D74E2E004D3C37F24B8E69E7
SHA-512:	BE05F5A15A134BF21535E91B705B3657D5EA571C84E57848CAB3C50D107FEBF7738D91701793FFEC87BDB370AAB1C0A22C3E7B22AFAC39875B4AC7E9FF00097D
Malicious:	false
Preview:	(.....t.oy retne..........................S.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlQB+l/:Ls3Q8
MD5:	D772FDDED37762237602C70441466881
SHA1:	FC0FF9BB5C165B13B445F82D804C4EE67B490773
SHA-256:	E4BC717E3703756EC3572FFC6CDF5C956F5C33F2350AA6D3DFFDE15AAA84487E
SHA-512:	5D16E625B99EC24D6F1F08614BC9C12373628B6FBC8E177836AE55ED288FAE2AEA6AC2CE211C6F2DBDC47EBBCD09C5E417159D92204438658F7F017DCBE9226E
Malicious:	false
Preview:	.........................................\m.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3541451270850535
Encrypted:	false
SSDEEP:	6144:FA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:FFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	642CABDCF29F63DB426F46FEDDE804DD
SHA1:	8F23EF95CEF8EA19EF5BC5BC55551F5EC659C6DB
SHA-256:	6D5BF5BEEC290201AC471525236ED524D675F8381289E6A9397D91F517E5FF00
SHA-512:	968CE87FCE64F329F92216F313CFCDBA130584556410D3D078E0B1B21D704C8F55AB9113C22885E4FACC6360F143F47D5ED9D88AE8EF2AF495393BAC690BCC09
Malicious:	false
Preview:	...m.................DB_VERSION.1V...q...............&QUERY_TIMESTAMP:domains_config_gz2...13369580821645087..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.207648164392971
Encrypted:	false
SSDEEP:	6:us/4XaRRM1wkn23oH+Tcwtj2WwnvB2KLlEs/Fq2Pwkn23oH+Tcwtj2WwnvIFUv:dwKRRrfYebjxwnvFLltvYfYebjxwnQF2
MD5:	BD6745B1AA9581F974798AB53F297E97
SHA1:	D5F1FA3159542BCAE7F405ABAEAC5601103C782A
SHA-256:	BD15B9FBE57A6FAA764BB340029787DDEF08C714B73FCD883ED843391DFE9ED2
SHA-512:	C5EA7C113DFFA51B93389526CFD898AD8AC2E39FF77455422167A264DCE66F31647E64AB9B53C3B7778EFAEA63D5BE9C9B9F3720BC155CEED8287E99642FDE18
Malicious:	false
Preview:	2024/08/31-08:27:00.911 22b4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/31-08:27:00.973 22b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324614573026567
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rk:C1gAg1zfv8
MD5:	FAEC52318C4EE1DDA7210CE70D7CB228
SHA1:	5DC8291D4053A3A9C3C7FDCD08DA7EBB3AF9E4A8
SHA-256:	6080561CF0E48D3A9CC8F483FB2BB7CF6FBDE1BF8447D0EA413CDF4CC17A0F0A
SHA-512:	D11473350B63C801BDD0336554F120433C8FDC412DECCD1D05CE5AE6ED8E1D108279990A8D2B67DE7A6C3CD0892D6874750FBB09C008B0E48B126C372919F497
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.2277829645136675
Encrypted:	false
SSDEEP:	6:uceCr1wkn23oH+TcwttaVdg2KLlEceQBQyq2Pwkn23oH+TcwttaPrqIFUv:GRfYebDLOQBVvYfYeb83FUv
MD5:	8F65AF0F77E76B17F7F395BB37F1AF23
SHA1:	84AF69CD6E118C5A1EE3FC00AE3820D4E1F5CF72
SHA-256:	2EF86A2F94F1E846054047E307521FB463FC2E7CDE8669B758B7F93765C7DD76
SHA-512:	90733A4CEBA06D325C279B225B78710AA7B1904E7711C2AEC27E3E8FDA32976E08533A712EC669AF764B4BFDA8B80C4EF194AD4B992219FAB54CADB7A336FDB8
Malicious:	false
Preview:	2024/08/31-08:26:55.771 1f30 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/31-08:26:55.783 1f30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.232293194173002
Encrypted:	false
SSDEEP:	6:uce0e1wkn23oH+Tcwtt6FB2KLlEceEFCQyq2Pwkn23oH+Tcwtt65IFUv:G0pfYeb8FFLOEIVvYfYeb8WFUv
MD5:	BBEADA3946213C004CAF403893EC241E
SHA1:	CC43A0A7DD9E49B82DC4700856D3BE818DB7A78B
SHA-256:	117CF12259BD32320EC2867C08E16EC33634B3A97DEE681CE5F68A7368E8ED63
SHA-512:	C4AD47FD71DFF2D05A0CB6B50C14C4A8AA274352E87A8E9CE758A57350718C2A351CD52033444DB9BFCEE2EED7FF3520A710030237732BEB0113CB8A55CA1373
Malicious:	false
Preview:	2024/08/31-08:26:55.785 1f30 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/31-08:26:55.799 1f30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.193474717236661
Encrypted:	false
SSDEEP:	6:uc4ROI+81wkn23oH+TcwttYg2KLlEc4R3oOq2Pwkn23oH+TcwttNIFUv:UOI+bfYebJLM3oOvYfYeb0FUv
MD5:	AF7C6BFD368AB9A39002C4D5C3E01BB0
SHA1:	60EB6464732BAC04926534FCCDEB7D5D1FF41841
SHA-256:	406284CBBF128C744D439B7127ACB22AF5411F4DDBE32A3902BCEFA114E622E1
SHA-512:	ABC47F98B62CAB3C98C3D0DD3F25FBA4E7A7139FA21E1DC6D9994339AC934BB23483C0F9A7859A6D50770C20A46EEA0EA3516713BAC0EC6D8DC378AB1B1F996D
Malicious:	false
Preview:	2024/08/31-08:26:57.422 1f10 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/31-08:26:57.445 1f10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlWXTt:Ls3Wh
MD5:	43E6555F9FA7133E8A2A60DF2CB4564A
SHA1:	9D2B1026410F76CB417BC050DB3CE853EC937E12
SHA-256:	72AE10B5BFE4933E66E901D2E2AC24B1A70CACC92C2C433A3E7B4FF33F8188A9
SHA-512:	7EC9D4B76894F755EFDD235DA58896ED7E9BB6D00A712F5EA10974158328B214098BAC252BFD229E96A33EBCBE6328AC2F2EA11B28C9E6989F96611D441A055D
Malicious:	false
Preview:	.........................................g.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:mHj9tFlljq7A/mhWJFuQ3yy7IOWU1GKtdweytllrE9SFcTp4AGbNCV9RUI7:j75fO9td0Xi99pEYZ
MD5:	5AFFF6CADA11E01AF5AD90BEAC9B44E8
SHA1:	711ECC291CB706AAAE04B07EB21FE76870CE3790
SHA-256:	933C2F65EF77BBB4C86362F7B26CE34B59A9304443BBEA98DEC839F73CF69A08
SHA-512:	C1A42769C8D8CC074769CDD8ADEDDC5BAD4FA156F3F3F7BFB9914B6CCE19279F0992910C5A770BAE59899834C0AA84065A409221CD506548419C17C97788E832
Malicious:	false
Preview:	............A......&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.236886921782067
Encrypted:	false
SSDEEP:	6:ucw0oRM1wkn23oH+TcwtRage8Y55HEZzXELIx2KLlEcfGZ8Iq2Pwkn23oH+TcwtV:Y0MrfYebRrcHEZrEkVLeZFvYfYebRrcU
MD5:	3FA24AD213F2EF2EA8F41EABC4A22A1D
SHA1:	EDFCDF5240920DC7781E2BABADC4C2692240DAD9
SHA-256:	39BB46EFDE8BACC3BE76216219FD6A2F8A83DC9938EE385F976BCC634E25E255
SHA-512:	BC9A55ED8D54EA4152067CC0E9A28AE19EBE49CB511AB5C2FF51700E1C394776D2634DE0282EC54C5C5F9E86B874139A9B814BDF35CBBF44ECFACE41AA2A68ED
Malicious:	false
Preview:	2024/08/31-08:26:58.388 1ee4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/31-08:26:58.427 1ee4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.224761496565062
Encrypted:	false
SSDEEP:	6:ucKKRq1wkn23oH+TcwtRa2jM8B2KLlEcrR+q2Pwkn23oH+TcwtRa2jMGIFUv:iKbfYebRjFL4vYfYebREFUv
MD5:	108F497C7F63B0E7006FEDDA36359F24
SHA1:	24046B5AE078398F40EDF3B3D1F41C0B5B74C7D5
SHA-256:	EAA800F3703801B23746C020F27981AD20A6D4E416538E231BDF3391B12AE098
SHA-512:	9697B6FBFB7B4C4C9326E78BF29741EE9FEDAF2404EB4606E0ED2F636FE083E87AB50E0BCB9D537C42D05BA465425ECD416B8D7DA5A901FC2BC4F14BCDE1A5C3
Malicious:	false
Preview:	2024/08/31-08:26:56.323 1c18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/31-08:26:56.366 1c18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\4a5bf4ca-49fc-4ea7-ba06-c90a3a09c203.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\4becdc1a-36a5-4de1-85f6-5c13258d3f67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbRHeHBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ubIa4MS7PMVKJTnMRK3VY
MD5:	633DDD1B4920EC5BE074DBE9C025C0CA
SHA1:	544DEC5ED8BD3FBAB234940BEA45390B5CEF13D1
SHA-256:	8FCAE56F81D49DE83AC45BB8848E818C99462EEE03D017124E895D39630B3889
SHA-512:	CB89ABA6C2D59A7D520BD1BBDB85CBDF5CFBBE3DC9DFD02E06071F8597E3EB0D3B3BE3587AE58870B92127379A2C875A856F11B6792D4A68C5204837814549A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\66f2d68b-71aa-4e26-bc74-29be842f3f9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\8373dc78-cb18-4d88-817c-b99a51350673.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3b17e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7609618629943952
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBk1c:uIEumQv8m1ccnvS6SPjw
MD5:	AF75BF0C541340A57B492713B3E70BFF
SHA1:	66E2FA318A3598B68BBF9ED51D84C85618F70CD3
SHA-256:	A9051D7ADD5B152866608974D57938EA4FC6711D8C7B7352C47C60C2780C8A83
SHA-512:	C390A482E6B2B91DD636BE20AB648D4445684028EDB8B6403984C2F6B1C0EDD313960520C969A52C25B730AA3E54B016AE284CF2978874FA84A94CF982DB64B1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF293ab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\a032bd75-77ee-41d8-8b52-439fda085144.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.970448533262721
Encrypted:	false
SSDEEP:	96:stkqfois14b9x9eN8zGPs85eh6Cb7/x+6MhmuecmAeLfM2MM/EJ:stkOseeNkKs88bV+FiARPMMJ
MD5:	BFD3665F30F5D0DA5C7FF261A7F2B145
SHA1:	CF5C1FDC16C552F51C561F4E9E965A2240A0E37E
SHA-256:	B8B3ED8EFFC8098AA4C914E43F44179C082C1723F2159F1A58B4167ED45D57F7
SHA-512:	4EDE131925EA19347F48CB642F8143CEB73FD25090E27A49ADC3BE2F37D5A47EDFECB77CE0E0A7CEA3E2014EECE484BD1BF63EC79D8C40E2E42CEDA8039FD1F1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369580816942153","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369580816960827"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF32433.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.970448533262721
Encrypted:	false
SSDEEP:	96:stkqfois14b9x9eN8zGPs85eh6Cb7/x+6MhmuecmAeLfM2MM/EJ:stkOseeNkKs88bV+FiARPMMJ
MD5:	BFD3665F30F5D0DA5C7FF261A7F2B145
SHA1:	CF5C1FDC16C552F51C561F4E9E965A2240A0E37E
SHA-256:	B8B3ED8EFFC8098AA4C914E43F44179C082C1723F2159F1A58B4167ED45D57F7
SHA-512:	4EDE131925EA19347F48CB642F8143CEB73FD25090E27A49ADC3BE2F37D5A47EDFECB77CE0E0A7CEA3E2014EECE484BD1BF63EC79D8C40E2E42CEDA8039FD1F1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369580816942153","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369580816960827"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF39972.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.970448533262721
Encrypted:	false
SSDEEP:	96:stkqfois14b9x9eN8zGPs85eh6Cb7/x+6MhmuecmAeLfM2MM/EJ:stkOseeNkKs88bV+FiARPMMJ
MD5:	BFD3665F30F5D0DA5C7FF261A7F2B145
SHA1:	CF5C1FDC16C552F51C561F4E9E965A2240A0E37E
SHA-256:	B8B3ED8EFFC8098AA4C914E43F44179C082C1723F2159F1A58B4167ED45D57F7
SHA-512:	4EDE131925EA19347F48CB642F8143CEB73FD25090E27A49ADC3BE2F37D5A47EDFECB77CE0E0A7CEA3E2014EECE484BD1BF63EC79D8C40E2E42CEDA8039FD1F1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369580816942153","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369580816960827"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566609620375085
Encrypted:	false
SSDEEP:	768:/EOSyRWPKQfi58F1+UoAYDCx9Tuqh0VfUC9xbog/OVirbw8rwDpGtuU:/EOSyRWPKQfi5u1janPw1Utf
MD5:	01A7539481B1A080B0B0E1DF10C5B19E
SHA1:	18AD905C0D44D61F414DFAE98B08D0F4771EDF40
SHA-256:	69D50AD3261DCDDC111CA840A38B7DF6921EB63A2E2AFE4BD418FB1CC3058371
SHA-512:	3FEBC53838D0C642C86C855A48789E38D6125464AB31B527E54109B1674B96C527C88EFA98DBE36E20DF079845814E77D5AA792D269924FF2ADAFD64F72FF705
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369580815748367","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369580815748367","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2f37e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566609620375085
Encrypted:	false
SSDEEP:	768:/EOSyRWPKQfi58F1+UoAYDCx9Tuqh0VfUC9xbog/OVirbw8rwDpGtuU:/EOSyRWPKQfi5u1janPw1Utf
MD5:	01A7539481B1A080B0B0E1DF10C5B19E
SHA1:	18AD905C0D44D61F414DFAE98B08D0F4771EDF40
SHA-256:	69D50AD3261DCDDC111CA840A38B7DF6921EB63A2E2AFE4BD418FB1CC3058371
SHA-512:	3FEBC53838D0C642C86C855A48789E38D6125464AB31B527E54109B1674B96C527C88EFA98DBE36E20DF079845814E77D5AA792D269924FF2ADAFD64F72FF705
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369580815748367","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369580815748367","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.148513730410927
Encrypted:	false
SSDEEP:	6:usjJEFmRq1wkn23oH+TcwtSQM72KLlEsrN+q2Pwkn23oH+TcwtSQMxIFUv:djWFmbfYeb0LlEvYfYebrFUv
MD5:	BE1EB813393C1AA8C0A49AB03E0B2FE8
SHA1:	92A9997A6EF6D73ECD0FB29F95D5F83F60AD76D7
SHA-256:	C4E049F250C1A393FBCE8D9E320720C55B7E9E7A5DF9B4DB398BCB5935F483F2
SHA-512:	7FBC4B4097D65F2C055F64266DD5D6503507E59DA13D35B490CFC8AE39125EF39232E486A150EF77695E36E84DA064B9D3F7897FEA415EBE3032CCF82ECD0404
Malicious:	false
Preview:	2024/08/31-08:27:13.235 1c18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/31-08:27:13.252 1c18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.118309353315442
Encrypted:	false
SSDEEP:	6:uceXyF1wkn23oH+TcwtgUh2gr52KLlEceeMQL+q2Pwkn23oH+TcwtgUh2ghZIFUv:GXxfYeb3hHJLO7Q+vYfYeb3hHh2FUv
MD5:	72DC3A9DC4AD34EB027E774167428873
SHA1:	180A851E376E1B18D3BD69C5E62EF034D0A723C9
SHA-256:	FC50BB37B81CECE251F4A26216A7543E200BD96F23FE287E1F03FB7F68A77395
SHA-512:	77744B7E94FBDDBCD96E19C167B8F4149BEF8178B9871680BCD2CEF31785868EF2D9B219B3DB4F63865923FB632AF4E037D42778C67C11535C7D24508FF23BDD
Malicious:	false
Preview:	2024/08/31-08:26:55.809 1eec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/31-08:26:55.836 1eec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul3+QKX:Lss8
MD5:	2B1B711A03405E940DBD96EC990A0468
SHA1:	9727B00E4F6921BCEA2271DD6A73CDBC7BDD49D5
SHA-256:	0DCDBFA53EDF92BB81FE2DCCBC80030F0AE0D04E8EF61225268361AD1AE05C2E
SHA-512:	A0D657CD8FF5C27A5F4E59FAD9FACE8542434A1BF9E976FB859DB52428DA43EDB41F90CC67941E767F89E672CC52E4C817A086FE51007E6004B467EA6754CCEA
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:bUlc9EsCM+fln:Al1x
MD5:	BEA51A6F3DD4B0C7383D844037FEAE6B
SHA1:	58779AF3BFC0077EC2386CD9C00B6A2286E68447
SHA-256:	26110037CD4C5544A0CF14A68EB10595C0C9CD5AB3264456F55C77106F1C536D
SHA-512:	47F6EC88A75B944319CCE681FFEBE8C468D99C1D22B1BBA7421ACD5355EC5832C14830867BE85073C0AE1C925F37B74435A38E16D974FA100571BC3794FEAE03
Malicious:	false
Preview:	(....".oy retne..........................i.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:bUlc9EsCM+fln:Al1x
MD5:	BEA51A6F3DD4B0C7383D844037FEAE6B
SHA1:	58779AF3BFC0077EC2386CD9C00B6A2286E68447
SHA-256:	26110037CD4C5544A0CF14A68EB10595C0C9CD5AB3264456F55C77106F1C536D
SHA-512:	47F6EC88A75B944319CCE681FFEBE8C468D99C1D22B1BBA7421ACD5355EC5832C14830867BE85073C0AE1C925F37B74435A38E16D974FA100571BC3794FEAE03
Malicious:	false
Preview:	(....".oy retne..........................i.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:N78yEukUl:Ww
MD5:	81E7F099330AE92DC38A5A39D985089C
SHA1:	01E53D63832EE2515A2EC5611195598CFB070063
SHA-256:	E04729C6C0A7EF4A586C99CA389ECEDDD9A9CAC6A88C8A8A416898A646FBC9DB
SHA-512:	3782D19B9E55962E8ED7AD0FF72200C2D32F14D627104893542627C617A817DF0E579076E80A5C864BC5569C502BEEC2B2783CA2D2A31B8D4B776B76415E2D09
Malicious:	false
Preview:	(.......oy retne........................2.j.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:N78yEukUl:Ww
MD5:	81E7F099330AE92DC38A5A39D985089C
SHA1:	01E53D63832EE2515A2EC5611195598CFB070063
SHA-256:	E04729C6C0A7EF4A586C99CA389ECEDDD9A9CAC6A88C8A8A416898A646FBC9DB
SHA-512:	3782D19B9E55962E8ED7AD0FF72200C2D32F14D627104893542627C617A817DF0E579076E80A5C864BC5569C502BEEC2B2783CA2D2A31B8D4B776B76415E2D09
Malicious:	false
Preview:	(.......oy retne........................2.j.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlu+l/:Ls3uq
MD5:	34FA5AECD2A3B8A555FAD4018AA1B294
SHA1:	196F2A0ABA5188DB872865F2E3CB962DE91FF82C
SHA-256:	2F23A146BBF60D4D316CB4416FE5FAD28D6B6CC274D1AA73F7AC5615ACB7935D
SHA-512:	4DABB5199C301A9FE3EC8FDDBB54A3848E3F6896C9B4F1981593E827FC97C6EBBB9EC31B81F8AEE02A66CE06BCA19540588E01BCD567C19B403A0515B0816A10
Malicious:	false
Preview:	.........................................Wo.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlpaa/:Ls30q
MD5:	CF72A457BA332898B371BC167F43A3F6
SHA1:	A8A852194598A089DA107FC7E3E3ACA5AD41AB80
SHA-256:	A1B56CDB9DCE5A160E1C1B32519B4865976CDC62042F40BA7C53DA76F81DAAA0
SHA-512:	724E03EAE9E3461B8469647E36D1B78E54B5E4506D9B402FD4CC9C7ECC9F5B3505296517D549C4B26179DC2F5E9FE5C4660BCC38BB7A93F2FECFECF7C3DBBB17
Malicious:	false
Preview:	..........................................n.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.241006302222442
Encrypted:	false
SSDEEP:	6:uc4R2Lc81wkn23oH+Tcwt0jqEKj3K/2jM8B2KLlEc4/+q2Pwkn23oH+Tcwt0jqE0:US0fYebqqBvFLc+vYfYebqqBQFUv
MD5:	66045211A950E22FB6FC8DE8181DFEC6
SHA1:	FC72B96BC7969023329559933C11A1644052F821
SHA-256:	90478F093744CCC6398CCFC8B9C2A21FE33AE215942510722E760BF77A5789FC
SHA-512:	A173B77295921020AD465EB056092A3BC8C8F690304FEAA50CA7235CFEE878F2B7D9C0EB24B950E7765E08462F6810738549F499A46D01388EF2F6745993FC36
Malicious:	false
Preview:	2024/08/31-08:26:57.430 1c5c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/31-08:26:57.501 1c5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\70ad1b70-8f27-4217-a4c2-f47a2efd90a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3b298.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a9c5189d-629f-4e0f-8a8d-89dc706728e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ac3f059d-142f-4b4f-8207-cfec0828e707.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b57a2746-2695-44d8-a2da-fdf62404d56e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.220691019326681
Encrypted:	false
SSDEEP:	6:uszlKRq1wkn23oH+Tcwt0jqEKj0QM72KLlEsM3+q2Pwkn23oH+Tcwt0jqEKj0QMH:dzlKbfYebqqB6Ll9vYfYebqqBZFUv
MD5:	5D83431D500057A01CCF55BF68BB9203
SHA1:	6BB26FC5BFE643C1B04D46D8B56B88AACBB47F8C
SHA-256:	D938EC61895B5A2AFB56F9A7621744F34F2050453F7862770F9FFF83BAF81EAF
SHA-512:	B7E7B9F623C25632F296B66029F801165DAEBBC06EA9A9B3C272DD1A627876FC046AE627C0964302A639D94252ECB916D828A62B617D9DBF0A7AEB1C0908438F
Malicious:	false
Preview:	2024/08/31-08:27:13.441 1c18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/31-08:27:13.769 1c18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.247784592296361
Encrypted:	false
SSDEEP:	6:uceJ081wkn23oH+Tcwtkx2KLlEcUq2Pwkn23oH+TcwtCIFUv:GJ0bfYebkVLkvYfYebLFUv
MD5:	C5F0CDF644D7C009E9E93C31537BF09F
SHA1:	9AFE27FAB22DFEEE8D394C301120713DB00CFC83
SHA-256:	5B54E3FE8568DB4E47F2EC5A74F661ED0EA7393C0E0D1421395F42940D8D8F7F
SHA-512:	F78010F3D411FB725C47EC994B927E7CE791F6B66F094D642936A487B2959A4BB25C8C09C9F4674A319A1409F04705630785582924B0F67F13C5B699FBC3F253
Malicious:	false
Preview:	2024/08/31-08:26:55.835 1f10 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/31-08:26:56.057 1f10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002095330713584969
Encrypted:	false
SSDEEP:	3:ImtVD8All:IiVD8A
MD5:	60CAD494B626A47C6A787E2311D94E83
SHA1:	650159DEACD7D0241AE3CBA085D3B6F9B4D5D337
SHA-256:	E96C2519E764BBA4907AF82249115D01EDB25C2EB1977C917C0EC4DDE4ED7FA4
SHA-512:	F192DBA903057D4FD393C312F8490F669CDD486E9955EB0E4117E770240C31A255DB899A74B5280A13F81B7190C40B473024E16EE05F843A67B0D96BE618AA29
Malicious:	false
Preview:	VLnk.....?.......L.W..Y.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0769710089034568
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOKSAE+WslKOMq+vVumYfin66:e/2qOB1nxCkOKSAELyKOMq+vVumdp
MD5:	D006994C07CD4FB76E914E5B0E1C9064
SHA1:	282B5859A2743AB610725A5EB67D59D1260B5297
SHA-256:	0BE3B2E9217441E735052EE7F7ABFBAC9892392AC5CF11DF21E2C98B7DE3C243
SHA-512:	4E9EDA017D0FB19AED5879028990281FD246F1C00BF36ECBE59E69EB2E672FDACDE1B719D062182DE69674FE66F913B8BB77F0B4E4A1D38DB29301726392BF3B
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\b332a19d-9cf9-4b3c-b2f8-3dfddaa1c237.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.970448533262721
Encrypted:	false
SSDEEP:	96:stkqfois14b9x9eN8zGPs85eh6Cb7/x+6MhmuecmAeLfM2MM/EJ:stkOseeNkKs88bV+FiARPMMJ
MD5:	BFD3665F30F5D0DA5C7FF261A7F2B145
SHA1:	CF5C1FDC16C552F51C561F4E9E965A2240A0E37E
SHA-256:	B8B3ED8EFFC8098AA4C914E43F44179C082C1723F2159F1A58B4167ED45D57F7
SHA-512:	4EDE131925EA19347F48CB642F8143CEB73FD25090E27A49ADC3BE2F37D5A47EDFECB77CE0E0A7CEA3E2014EECE484BD1BF63EC79D8C40E2E42CEDA8039FD1F1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369580816942153","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369580816960827"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\e4e945ec-7ecc-433a-8e36-b820764f53cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566609620375085
Encrypted:	false
SSDEEP:	768:/EOSyRWPKQfi58F1+UoAYDCx9Tuqh0VfUC9xbog/OVirbw8rwDpGtuU:/EOSyRWPKQfi5u1janPw1Utf
MD5:	01A7539481B1A080B0B0E1DF10C5B19E
SHA1:	18AD905C0D44D61F414DFAE98B08D0F4771EDF40
SHA-256:	69D50AD3261DCDDC111CA840A38B7DF6921EB63A2E2AFE4BD418FB1CC3058371
SHA-512:	3FEBC53838D0C642C86C855A48789E38D6125464AB31B527E54109B1674B96C527C88EFA98DBE36E20DF079845814E77D5AA792D269924FF2ADAFD64F72FF705
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369580815748367","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369580815748367","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\f570cb2f-1070-4b6c-b406-b9dc8f358e30.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566519716855668
Encrypted:	false
SSDEEP:	768:/EOSyRWPKQfF58F1+UoAYDCx9Tuqh0VfUC9xbog/OVirbw8rwzpGtu1:/EOSyRWPKQfF5u1janPw1Ete
MD5:	6C82CC40F5DBFD4C86C0DB57FE4863BD
SHA1:	5B64081894F581776E01D6B5ED82D7B15FF177CC
SHA-256:	55F43E6131044E4B86854E6CB86CFE132A8D06301D90001A27AFB77A56EC5D8A
SHA-512:	B53C9118B3D4A903FB98B36858389EFDE8BD0F95B36426CF5C36C1375350CAD7801E7A82EFB858DD8CACB9FC4AADF61C0DF345FE8C5B853CBFA0D8D3006765D0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369580815748367","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369580815748367","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\f80e6b75-3712-4896-ae43-e19e9566dbe3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.9801992796924965
Encrypted:	false
SSDEEP:	96:stkqfois14b9x9eN8zGPs85eh6Cb7/x+6MhmuecmAeLhQU2MM/EJ:stkOseeNkKs88bV+FiA8PMMJ
MD5:	6C0C2F5C05D22103BFEBAB2A1E81CD06
SHA1:	43DB6019FF9BEBC646DB4851226EA45C55228F8C
SHA-256:	F0EDD579E4F4AB5C7F34B409581B02DC5965A0FA719E9BFE4BB56224714BEA97
SHA-512:	83050B4318981A9D80C9FD9F1E588C9C6E06CA868100D3E93E745B28088369E8830E436E25BAD49BC23B9D5D74EFC0C4D871EF85BCD9F9297AD8AEF188B0A742
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369580816942153","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369580816960827"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/6oqetdlFll:7+/l/5
MD5:	8E5E3B6802E761DF7C870ABBBBA9AB1C
SHA1:	ECB19DC64F267B977FB1486B73F65440AD0CB648
SHA-256:	D01A95986FEEB47E351402ADDBC0F6E69B1EB1CD5BBA962285C00D3137EB8758
SHA-512:	35152B5F655388B25874C21929D5DE8FC3F07A76F616B3286BC7403A37E36D0CA843A1318436C148DA671B776A2FF3F9502447EE800EBD426B68C08DD0E77AB2
Malicious:	false
Preview:	.... .c......MO;................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05022808509896411
Encrypted:	false
SSDEEP:	6:GLW03gVpW03gyML9X8hslotGLNl0ml/XoQDeX:a3gb3gLGEjVl/XoQ
MD5:	6DD01CFDEAF58E802B575E61F30C358B
SHA1:	58E3720657A7EB15C5E03F45EC0C6EBB390BFF2C
SHA-256:	7BD32599CC871D259798CFF53E08ED6501C59AAEB308058743D5E602C397905F
SHA-512:	A6DEAC17B121D10AC5EE787CE69B1448D8E82A821846E9A3E6A8FF7A26A182B290ED4F87E9217FE765D9036165AB2F42D455FA8AB978EE2622A01C13DE2763B4
Malicious:	false
Preview:	..-.....................Q..C.F.y..p&]~/..Z{......-.....................Q..C.F.y..p&]~/..Z{............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9978023948109728
Encrypted:	false
SSDEEP:	48:VDzxRIUlO+d8cbX+D8n9VAKAFXX+BT62VAKAFXX+rxOqVAKAFXX+2rynUYVAKAFx:VnxRIYUD5NsoNs9O5Ns2rdNsLe
MD5:	372A645C7C8820748615C0CF256C5660
SHA1:	93447F77E6BA3451434B390396EAB6D3B81A63CE
SHA-256:	F486EF3379C49AE32ADAD91B201E68938D034477517C6BDDB6D3AB2A1F27DF2A
SHA-512:	4B7B5B2F95F547A293427AA911EC13C53C5C9FB2E880713BF3BA5E8B99F3B61DA98A550E4A3FA32C3C8FF2BA25A28EEEAB2E973965A221237DED4CF163887A16
Malicious:	false
Preview:	7....-............p&]~/..W.o:...........p&]~/...\|.J.1SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.472766688734912
Encrypted:	false
SSDEEP:	48:e8SSBStVgQAPkuHRHXxtIYjIYzzVFqk2MYjMYjyMAlkfAlk43:J0t+QzkIYjIYzzjb2MYjMYFYcY93
MD5:	CC5D59AEF5824768CE6D50AEA34F7965
SHA1:	1ABD17BBF592DE94C4FAFA669B8C30C90B1C555A
SHA-256:	453DFF4DFCA7778D6E2EA4385DA732BC107381F2E76DFA9505DB9931F8CEBA54
SHA-512:	AD7E82DEB6DB3BB9B8109DAA1684784F8F433047460376443951B47D621027B357C9C32DCEC112E665A021917E0CB9FD97FA33D797765CB448AA7AC790BF1667
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1Cc.T.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.249527862843232
Encrypted:	false
SSDEEP:	6:ucRF+q1wkn23oH+Tcwt0rl2KLlEcWIq2Pwkn23oH+Tcwt0rK+IFUv:q1fYebeLvvYfYeb13FUv
MD5:	001CB6284CB8BD0CD93518F41550362C
SHA1:	E90024FD442952116B27E2A0EE42495BE41A02DA
SHA-256:	DD0BA86CDE41A604F96CC148336729C2C6C2ABB46C1E4EDDE2B33BACFE5C75BD
SHA-512:	C160C5B03593AFC410F0FC7FF6D4F5A84FD83E0C96E3BBF18C2B82DF613A35EE6A2876A6769B9578392F528B3CC4318091D867DC9249A219F2F104B1E7ABD327
Malicious:	false
Preview:	2024/08/31-08:26:56.280 1ef0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/31-08:26:56.292 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.958141412815535
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Wui+it/4JbZfPStub/RG0lbANqa:G0nYUtypD3RXi6FZfc25m
MD5:	FBC524D02048C176A0A5D1B8B752932A
SHA1:	294C48557549A4C978326D9B7969E293A024F157
SHA-256:	F3FC95AE128DB918FC126F15CD9D96618482BA6ACCC622AAA19B10CE80B15EA0
SHA-512:	9B6434442E11610B8B5DDA43AA56656599925C9C8F0A364DDB69D15B37A912D223EE600012468E0DB723CAF3546FFBDF56F085A0159EA7968BBACE894AAFF856
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................37_.......`.................38_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....:.=..................3_......W2..................4_.....)..>.................37_..........................38_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.217774947253655
Encrypted:	false
SSDEEP:	6:uc3+q1wkn23oH+Tcwt0rzs52KLlEc1+q2Pwkn23oH+Tcwt0rzAdIFUv:G1fYeb99LF+vYfYebyFUv
MD5:	32DADF88FD30BC116FAE605FC5535849
SHA1:	CB3CFFBF1B484AFC505C713EE9E3A6C26B47AE53
SHA-256:	2495851BA9CB1C03B527BB6A34CB384D18B0581E372673B82C20F6123F357739
SHA-512:	278DB1D4BB0594289DCC49E58055A2AE3D0626EFFC77DF96B027BA2844135DC3E58E92CE36D063FD387244BEFE761E8DB675DA637CB0AE64A036BA18D28C8B6E
Malicious:	false
Preview:	2024/08/31-08:26:56.262 1ef0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/31-08:26:56.271 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl5DQ+l/:Ls35Qq
MD5:	9426D27907933F14514155590D2010B1
SHA1:	4F3F56273480136321672D2B084D26E68A762F45
SHA-256:	1F300652E9D6AED0D1E71AF694EEE3B587717EC3C364E0278562FEA5DC7554DE
SHA-512:	45E40417E2B68828693A4ABDEA7EF6C35A5CAE411A6C8A8F7530B64834C4D1C0CB197C6939C5BB699CF55AFFD16EA4934328836076B9664AB7AD325E68586F11
Malicious:	false
Preview:	........................................U.m.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlt//:Ls3tX
MD5:	643420E8BDE6994F9D620697A0F49C38
SHA1:	ADAA076F8139EB3A89912D876127A9B87CA638B1
SHA-256:	5BBA3CF092FAAFC2F4761E470BFA1B47EB4FFE23509F1A412C9B370F9D4C0973
SHA-512:	1916BF8369443439B63F75428B5B783AD59F4DF5EDBC66E014FF2A358E30EA9381A4756EB03311F100E6E955E9FB59B8A03CAA956B2DAEC3675AD87FF5D7C125
Malicious:	false
Preview:	........................................ONn.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2864d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28812.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28850.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2af70.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2d893.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF318b9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF34bfe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF37281.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF399a1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3fb78.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.523245854112088
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTD9b4YqaqcnxU1Xdyik1WJdXBuBuwBJaOF9Nh79XGQQRCYfYg:YuBqDPaf19RipzgBzBJxFR793B0
MD5:	D529727607A9523132EC4FD08031158B
SHA1:	39A8C2DC700D5BB32370FC93969ACFD75430BE38
SHA-256:	0C10AC411738097F7F91E537D08F1440BEE3C38CFD57D32EB51407295D1B9B8A
SHA-512:	CA2FCD6036C7878920559EC81F69BB5B60CD1B9D5290E44A0D338911E690156D417632B3FB74EBEA304420ED098E60FE2F65ECD9BD2927731F89E2577F3B7BC7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369580815169868","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725107215"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlP0l/:Ls3U
MD5:	601C88B3E53DFA0645E28FBDA34477B1
SHA1:	90A33B8EE3EEC5ABCBF6F97B90472D742D54AD12
SHA-256:	A5BA49002E95EBAC26B0E4F535B41FF30C482C22A959892C1C0FC1239B790167
SHA-512:	D00C0752419D306989104CD0E284C09F8B84536CF8E39E5AAF1433BDF51232B34E69990442D619F2958377D58B2F8C47C253441884F62ADDB0563478D361AD12
Malicious:	false
Preview:	.........................................sI.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ab4f5526-a9ca-4ef9-82e7-72db9f3cc644.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.064929430275503
Encrypted:	false
SSDEEP:	384:xtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSVaPnkRaRiV1PdQYT3W4Ad4n5A:rMGQ7FCYXGIgtDAWtJ4nZavkRaRiV11a
MD5:	7CA2D21AB95132143B26714E4D62B230
SHA1:	B86A31B4DAF8298856EC0FD4FCDA6E80A2652B5A
SHA-256:	5BF7D4CFD97E24ACDE48310A900D54963DC4F064FF6A9A517E4EEFF0C15800B1
SHA-512:	C53753105CD4289B203911E82DFE6935E38F4F55462CB73E8876DEB91998007D92791DFD43EA351A406AA7FF7A7C496BC97CC02B25BCB4C315AAFBAAB8856A89
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369580817315423","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\c2c28de0-61ad-41ca-9dff-f4771885e501.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.064879388516811
Encrypted:	false
SSDEEP:	384:xtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSVa4nkRaRiV1PdQYT3W4Ad4n5A:rMGQ7FCYXGIgtDAWtJ4nZaekRaRiV11a
MD5:	F7888CAF8BF08E6448C938A3A295F688
SHA1:	4B9BC8DC40459CB4715AB1475CDF937F59AA0053
SHA-256:	C45DE3F50C7D098BDC6F1E012212A8FBC4C58D9727B39797D227D609C8B1B441
SHA-512:	CAE24AAC39AC10D8ACC1FEC01C9014090830FA9440B974C002964FBA6B80FE84F536BF3F5FE2DF3F1985D6C7178C08C64B460374F78968BE5ACBDD180C3ECE3E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369580817315423","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\c446be9e-e907-47e3-a29b-7f20fffde088.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.580034126025458
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0af19Ri2wzkHB+Idrx1vBJxFunRx3aJkXBciwlRThHB0:Xq8NkC1f1q2wCBR3v/xFCxKJkRcH1Hq
MD5:	F8C8A6FEE47A163B634BA3C54719BE05
SHA1:	F3E6B7234B7CFD4BE50DDDA124EEB7141F15A141
SHA-256:	91BEABB785347C7D75344C8623B0AE5B30B30EB286FE1EB1CFC02AC4C8B09E1B
SHA-512:	BBC3BE3139EC161D3004717ED6CFF1BCF739D0F80EEB9E109858B6183366ADB7944076EF3324287254B7880CB74A5AC4D6F7FEB5DDDC4A6D6B841DCDA536BF44
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABeN5M4QG1ZcfUB5yngtKYds6/4n/LuwA57B/x/G9qxngAAAAAOgAAAAAIAACAAAAAKcubHFcortnGt3GqfBr55c65DEk7JgyJ528QPN1nrZTAAAAAkmmHrNRrTTDbfIJqMrZQoAvvg8b9b7Uu0zvkOSLyBOUBH2qs7EUemq5i1riSFIudAAAAAHufLgDMKS8FvWZLVRGXqI4RQQ28mIMRcxnPrhogFnZFAX3pbpgijJpvJlo9hAzUJ6uG9JPD3ePMpWvYVYjZdkA=="},"policy":{"last_statistics_update":"13369580815204870"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f11782ac-2d20-4292-a7f7-200a75dec0e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20989
Entropy (8bit):	6.0649155159534915
Encrypted:	false
SSDEEP:	384:xtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSVahnkRaRiV1PdQYT3W4Ad4n5A:rMGQ7FCYXGIgtDAWtJ4nZalkRaRiV11a
MD5:	147C1D81983378D4C4F6013E7CD30581
SHA1:	D3DD5D4B057ED5EC8E71AB7510B0EC0A5BD291FB
SHA-256:	9781F7A7024E88B089F6F876D839F2D3AFF8A633708599B513ACED930BB94F46
SHA-512:	37CD7604E434306AEBB6E292553C7C363CF29400C1A772A60A8D12B9C0CC77F3AF4DA898EEEDBAC7DC9B140E3F7E60AA29964F25AB3BDF794E4128D86AE7F89A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369580817315423","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\030c25da-a52d-4a29-bac8-49716d72bd39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.805866715714456
Encrypted:	false
SSDEEP:	192:fsNANqH8eiRUgdQWkRW6qRAq1k8SPxVLZ7VTiQ:fsNAB/ilRW6q3QxVNZTiQ
MD5:	CC39CEBB32157DDAAF4703E38D169CCC
SHA1:	FA40E3E72C1903A44931BA9191AE45569B7FC4FF
SHA-256:	135CF901A908EF6269A98CB9A54543BE4DD2204DF5F1EA4CA908A1B5E83528ED
SHA-512:	04CDCC2A242284AB10CA404D26486E2E6518FD853F73B6C71AB4C13D39114CC8C0E35712F20D0AA09A857472C7E4C10CE71EAD82D0DF61DC72EBAA0861FB9EAB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0a351443-94eb-4be2-ba8a-6f0ba999081b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24568
Entropy (8bit):	6.052741728899001
Encrypted:	false
SSDEEP:	384:ItMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNxDeKE4azd2z3p+Mh0lkdHd5qS:4MGQ7FCYXGIgtDAWtJ4nVKs2z3dh02tn
MD5:	831DBA34FDFA7378E42737AAB40959AB
SHA1:	AA20452A54B1A674FF5C928F90B0B9AD2B142408
SHA-256:	F9582AC7460429A67AD9142DB9B87D8A9D64981D31F7D7B4227FCB01D425FA63
SHA-512:	8573CA714DD2FEF0F39311BAAF76CF0D60F58FB824A803263D0301EFB18C997B46FD49BE9D95FF4C90642A1FA7641FA3989E2E7CCD49FA1DEEB236EF22E8D580
Malicious:	false
Preview:	{"apps_count_check_time":"13369580834871482","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpC

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\12ebc154-c012-4aa6-bca0-bd00c04da14c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.833587298588737
Encrypted:	false
SSDEEP:	192:fsNwNqH8eiRUhi1kQ5661rRkRf96qRAq1k8SPxVLZ7VTiB:fsNwBYCj5BORf96q3QxVNZTiB
MD5:	7B7FEA3AC7D7362DE67A7004B1E6B7C2
SHA1:	E80ABA86234595AF0A9332E880EB76AB5CE19E08
SHA-256:	BFBD4DF13F01AC206659B1CE349C3C4988E7FF45ED139B52E37E1008A1BF59B7
SHA-512:	185173C7997C478D3DB991344CDE8F20F0B3156EB47E61D9F182E0D7795F7BF03B259A03E19F8F5D280ED282DDEC3A2CAD8FE95D22BA0D9F838B7FCEAC00A66D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1cf2fc75-b355-4d20-a861-06354740c1df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21907
Entropy (8bit):	6.058385503475561
Encrypted:	false
SSDEEP:	384:ItMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwDeAlRd+Mh0lkdHd5qS:4MGQ7FCYXGIgtDAWtJ4nmAlRRh02tdF
MD5:	E052ADE529A8540792D77F9F46F814CB
SHA1:	E9BF7DE7AD4B117E756D6755C121A7172211A5A3
SHA-256:	FEEDD6ECC996CE2F309E1C1A23DA203A2D33C8CBC2EEBC3C1A1C02263C33D2C6
SHA-512:	7D7718CEC06D069EB762FB6EE77CCB4DEEE57470A76170E77DBBB091C0EF23964E47B772DA1C7831E4BA17D63156E084F703271BAAEB51B1EF75933505CB980C
Malicious:	false
Preview:	{"apps_count_check_time":"13369580834871482","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpC

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\295217fa-7a74-4849-a413-e577e153b250.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.833587298588737
Encrypted:	false
SSDEEP:	192:fsNwNqH8eiRUhi1kQ5661rRkRf96qRAq1k8SPxVLZ7VTiB:fsNwBYCj5BORf96q3QxVNZTiB
MD5:	7B7FEA3AC7D7362DE67A7004B1E6B7C2
SHA1:	E80ABA86234595AF0A9332E880EB76AB5CE19E08
SHA-256:	BFBD4DF13F01AC206659B1CE349C3C4988E7FF45ED139B52E37E1008A1BF59B7
SHA-512:	185173C7997C478D3DB991344CDE8F20F0B3156EB47E61D9F182E0D7795F7BF03B259A03E19F8F5D280ED282DDEC3A2CAD8FE95D22BA0D9F838B7FCEAC00A66D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\41af9caa-18a3-4af1-bb89-93b36e6376f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46425
Entropy (8bit):	6.081979266725656
Encrypted:	false
SSDEEP:	768:4MGQ7FCYXGIgtDAWtJ4nKe4QQzrW6H3pEjMrTAZo1++i0Os2z3xh02tdF:4MGQ5XMBGiQQpHKlWi0H2zjt
MD5:	711235A344E69DE60654C4ABD9963DB7
SHA1:	AF5E720FC055F2C4B3D9A4A3F686EDB14534DC5D
SHA-256:	02CC219CEB00B399C31E56364C98CE182545E22791DF4478AD1F993858F82EEB
SHA-512:	6D607277EB815150E95D591F8B483926A555F0302EC51CE71350F326B1B7E8589DE591DBF97EBAF25517986C15011D8DA896D4A86E60CBEC6832C7E68E9C7DD6
Malicious:	false
Preview:	{"apps_count_check_time":"13369580834871482","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpC

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\434035d5-2290-4863-a132-053cc30742ca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.833667126658018
Encrypted:	false
SSDEEP:	192:fsNwNqH8eiRUhi1kQ56LynkRf96qRAq1k8SPxVLZ7VTiB:fsNwBYCj5ZkRf96q3QxVNZTiB
MD5:	1BED8C818599E70EC9A99DB07A618945
SHA1:	8D92657A4DD305DD5E2E78567339B18E12522940
SHA-256:	550B46A2CE472C7469C54CEE701FA01036D94FD160EE1A0E87F2DA317D7A8459
SHA-512:	395B46D3C6061A24B3B9E74AB24DB2A86989F43FA20384F25521EC829CB36B134DF8422FE314C8F914F60C6C77995BB6C03B9806E99F7062C19C0FD4A3CA44E8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\54542278-83ca-4685-aa19-3619a169bf0a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46386
Entropy (8bit):	6.082088312736523
Encrypted:	false
SSDEEP:	768:4MGQ7FCYXGIgtDAWtJ4nVe4QQzrW6H3pEjMrTAZo1++i0Os2z3xh02tdF:4MGQ5XMBGJQQpHKlWi0H2zjt
MD5:	C0E3C0EC1F15B3F48C0EC407B69D05E7
SHA1:	785DCE295802F0697F909E996F1B9DDE8C3A24C2
SHA-256:	03FCBE4BD6B2C7E3F3AB2B369B82730909B143ACB4E42ED6633999264A5D9A40
SHA-512:	A6E68381BF4B842EFAB9BA1D1432162BBAB448293540E330D8800EEEF2108862702209743C0226895D244055F57E5D342E48380F5EC316501865244B02B6A96D
Malicious:	false
Preview:	{"apps_count_check_time":"13369580834871482","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpC

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\74e05f6f-8de3-4baf-b307-deb573d5788d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.799594488428689
Encrypted:	false
SSDEEP:	192:fsNwNqH8eiRUhIQHgkRW6qRAq1k8SPxVLZ7VTiB:fsNwBYVHLRW6q3QxVNZTiB
MD5:	528B7216F2573BDB1778FB1AA1CF0A88
SHA1:	F5E39325EA4474982E323D8E9BE66F2BA5C39260
SHA-256:	A1C9F467C4BC282B5E09AF667D3976D21F523EB9CCDD3945FBF4B99E0EC6C171
SHA-512:	424514A4DA8EF593AFFD3D2074E56E39FBB13CA98BC00A377715C2BAFB71520AA2E9175881FA2BEF42D96CB40A7AD6488AA5D0D286B043895ADD695D583840CD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\76979612-d31f-40a1-89cd-9ece0a17c5f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.833581225721611
Encrypted:	false
SSDEEP:	192:fsNwNqH8eiRUhi1kQ568jHmkRf96qRAq1k8SPxVLZ7VTiB:fsNwBYCj5FH1Rf96q3QxVNZTiB
MD5:	11192840054A71D673D9C188FB8816F4
SHA1:	C8D7A16717AFBF97D8B450CE6285E638CB765234
SHA-256:	B832093742A35761FBDD14A12F7A61F1CA8A1599D052BC74434DA0A7E8E3964E
SHA-512:	5CA8BF54EF0CAFBC2519BBCF1370E37815E467BDBFF70BF19BAF5B0F87655C8DEE27A00589B2664F6E7160627CC582EA341E6A705070421E11459BEE9A5217F8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\83d953b7-5d4b-4641-a9aa-5673bdf0b1bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D30C22-21AC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3096222193991479
Encrypted:	false
SSDEEP:	3072:v8MkLagycoOOcWF7lPM7BC8DTmNSjkJqvNdUXKH4FzYnDj10Uhk+HeqtWTzfpTso:gVIxNSjzvNdULrrxAaHZ6GrJaMr
MD5:	324F9832EB7A2DF6A18C5FE4A44F759B
SHA1:	084710F38C01B04C1BFC9311C2589C8883E71EF8
SHA-256:	AA1503A5539551DCC19410B601BA92DFE16C82394BD49A4B21E0CAC8D627930E
SHA-512:	84330240F5189C12EFB726656D8B3A35416FFC019E20E958B9F1F92332EBE992A77562181EB24DC6AE5C7C00D352F3AB2EF123B10A0AF2F7D089D4299862409C
Malicious:	false
Preview:	...@..@...@.....C.].....@................F..HF..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".dhficx20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D30C2A-1214.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03936498789698103
Encrypted:	false
SSDEEP:	192:yl0EbtmqvDMKXGJLMo40pNgMXMgrA0knzYhQANoEROI1gQsDCba9q9n8y08Tcm2D:Y0EtA4oiT4h5q7ggnCCq08T2RGOD
MD5:	8E482ACDD71751C9F897132DF9300D82
SHA1:	5C962AD166068FF4C50E685621CE9B73C47C734D
SHA-256:	7BDD5A2ECA49D553831459F3A0541FAA0C80CA48040D9BA0B7E05F743F34F384
SHA-512:	931AF148F0379E6BC42FAE73E593B489F52776684CD8620029EACA25D52EF71E79E908D6F8C183B4D9CD85A434AFDA4EFB6701AA04BCC731900B0F038649AE61
Malicious:	false
Preview:	...@..@...@.....C.].....@................_..XO..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".dhficx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D30C32-1A38.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03882953192431348
Encrypted:	false
SSDEEP:	192:XI0EbtmqvD3KX7xJEa3Xxx7UpXxgg6zfhj1NEx7GtxM1gQMi+iGq2n8y08Tcm2Rl:40Et4eZVQh52Wigm+Bh08T2RGOD
MD5:	B161D5B2EB013619D3B4EC99502B1C22
SHA1:	20CB89CEE27E9AF873452A46599F439903C3A1F3
SHA-256:	FE33F1BB69DDCF579AF9808E837F781184B3F101B7DE65C3DB47888AD7087F6E
SHA-512:	865C714402267E6221ADB11C66C60EF31AA6795E7124A9B5DECFBA6ED85AA374DA04D501104E70A080DF1574CCB1E11BE86725EEAD372F13B44538E41E747D91
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".dhficx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D30C3F-1A6C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03882103181470032
Encrypted:	false
SSDEEP:	192:XS0EbtmqvD3KX7LJEa3Xxx7UpXxgg6zfhj1NErZGtM1gQMy1OANq2n8y08Tcm2Rl:i0Et2eZVQh5WWsgu1hh08T2RGOD
MD5:	AB2A7BBEF3FE0B78A1F52175B87BF107
SHA1:	C747469E9A5490734DABDCF1AC5C54FC6C1B51DD
SHA-256:	F3B251066C46E14815E611B5656CB7E6CFCA5A75911BB32D695C068AEBAC51AD
SHA-512:	8A3665111ECBA8039A78B080E92EA39D4B0DC325BB8F57EE9913261D9ECD3725127624EC42A1743983A81D20D41B52F93E10CD2B1E769C5E2B44E6A773A8F3EE
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".dhficx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\070ddc57-bcb2-406c-a157-3ac7d13d14b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2ef3c3ef-8a18-4da7-8c3f-ccffa58c2c2c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.566050538617825
Encrypted:	false
SSDEEP:	768:5ENtOw7pLGLvAxWPrnfSs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzCestQirwuMop5:5ENtO8cvAxWPrnfSsu1jaSCeCQHuMctv
MD5:	26E69744BB9723B2CF4DE175EC1FCD32
SHA1:	8A4F9A58EE1822608185956EF5BEDC8578E0B7FF
SHA-256:	0C35686079516A617EAC8A111C8C5F8E56176905BA8182192198FD49BE4F6A4B
SHA-512:	4C724DCF5DA0FFC59F2C0EBFAC47728D86515A26239E020ACB42B7D4CDDD2F5A1CA557BB631C1D8D3682D760D957E0CBD022B94C5DD649D1BAE58308C014F171
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369580834629904","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369580834629904","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\392033a7-6040-4c46-acfa-2bf0badf21d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.176007677090489
Encrypted:	false
SSDEEP:	96:sVgYqlLJ1gb9s79a2xYuXEmnmSSeErY2sY5Th6Cp9/x+6M8muecmAeCr/e4zvrM/:sVgY0JLa2xPUmn49Y2sYPpj+FVA3MFBf
MD5:	44902A8C110EF3D604F6335802115DEE
SHA1:	3AD1BBB2A9B6000E9B8CBA065D2199E2F22AA126
SHA-256:	3937A865FF1455C4548E9C52BA99350BEB01A2C9D9F8AC3DDAF4FD3AD5FA236A
SHA-512:	BC5A743605DE2B0B44B7F35F465C500C74FF448369DAF0B2E3CF50F2DA4300753A913B2302EAFB48B233DEEF46E3845B08AE613A98CB33896346775F31CACB2C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369580834854035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\589cdaea-517b-420e-bb8f-0dd6b2922c11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9333
Entropy (8bit):	5.174857133563294
Encrypted:	false
SSDEEP:	192:sVgY0JLa2xPUmn49Y2sYPpj+FVAwhMFBf:sVgY0JLRxM04RpUVFQ
MD5:	85379D31CA36B7255C3234F7D2A976E1
SHA1:	D132670B38AB413E20B0B20C74B783048AE1E4A7
SHA-256:	3CB91125A51C4DA528366394541048E50D9C5AC6C93F014ED0C044FB7DE747ED
SHA-512:	2E546F2B8A33220BAE04B08DE5D541AC4F5AD3A76E0970CAB6ACADC6D82E98AAC6715FE0AE8033B5EE7D566451F25BB24CA7E379B5200FC7788631CD392ECE94
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369580834854035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8e5b574a-5638-4558-abec-aa8b7a1f0395.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558217615408309
Encrypted:	false
SSDEEP:	768:5ENtOw7pLGLvAxWPrnf1s8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtstQirwuipbtuZ:5ENtO8cvAxWPrnf1su1jaQCQHuitO
MD5:	BC2734750F5790FCC7AF0BA5CC560FAE
SHA1:	826AF4CCCAF635EAA42D4481752912D9796D3630
SHA-256:	18E252E72EFFFBAAB0A65453AEE01E2A8C6928DD32996B4CAEDED9EFDD77A6CB
SHA-512:	DCD19DBAAC9C0981CC502BDA9AF9FE98A5CDD9BA9A4D35B28DD5DEB9F77EA8323EF2EE189FC4CB61CCD3680218910A36AE8968BDF8282B71A2222E0FEB9176D5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369580834629904","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369580834629904","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321745338083116
Encrypted:	false
SSDEEP:	192:nAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:AOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	6282730B4140274B02EA9B76A0DB218B
SHA1:	A8022D7ADA453FB3DA48758D4385624D8EED7456
SHA-256:	947C1FB98BF6634A9AC898E1D288A6864CE53E75F5016D325F4A740618C708EC
SHA-512:	4531F225BE0C414B2D9598B54C56C6DBE0411DA41A4776B93DBF717490B793BBCF6C1E9C595BF2E18260DDAA92B15F0241DBB5FE6B6851FBBAAB832C4C48F02F
Malicious:	false
Preview:	...m.................DB_VERSION.1.[...................QUERY_TIMESTAMP:arbitration_priority_list4...13369580837536227.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.115784419318923
Encrypted:	false
SSDEEP:	6:usYRM1wkn23oH+Tcwt9Eh1ZB2KLlEs2kiq2Pwkn23oH+Tcwt9Eh1tIFUv:dYRrfYeb9Eh1ZFLl2kivYfYeb9Eh16F2
MD5:	8ED0075890C58C40F26675201530AA69
SHA1:	4BCDA3A462719E4C88CB9261890F14E8DC745B37
SHA-256:	6A9D01A37B786805BF33673F14759969340BAE8E50D9616B1B680FC7ABED7F9F
SHA-512:	CD74178774CE9177A1BDB80FCBED0515984555D526F8CBB954295C1EF681BD994268E9D9486A20841F4B6213104B3114FE084BFDBF9E3696AE48B349A9D53C5B
Malicious:	false
Preview:	2024/08/31-08:27:16.446 2304 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/31-08:27:16.842 2304 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlw71R:Ls3w7P
MD5:	50CAB1B5EA46EB933596288ED3D0509D
SHA1:	5EC05A26E410091434524348B85B885A4E463A2C
SHA-256:	08C792EADDB96496E27A5BBD89A570E3330C8AC4F0362F9761BD218F2F645979
SHA-512:	75914090D9FA7156F745EBAAEB6705EAC7D03682B49C2F370FB83E2B0DE5ADA8F4E37E99BD56DBDD9E47358D3CD8B6CC8CDB3E24D4B2AAF93BE93F1489DCC70A
Malicious:	false
Preview:	.........................................dx.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.207755233861915
Encrypted:	false
SSDEEP:	6:us3M1wkn23oH+TcwtnG2tbB2KLlEswIVq2Pwkn23oH+TcwtnG2tMsIFUv:d3rfYebn9VFLljvYfYebn9GFUv
MD5:	A616B2B1290FB4B987EA322D6844FA8F
SHA1:	1B9C10A0218ED921B90963EB1D6B67FC0B812390
SHA-256:	CA5CEADE199517335C2E873B9A5C75AF6324E377495D08FA1C557AA68C854D7F
SHA-512:	047505C5C4D989DBD774A12B2EE7F914281A9BCF2FFD4F8ABBAC53ADC3E9FEBECAD3A58FE1CF15732BB1FA1F0C7FC07E91DAEEBFE818F2A7512BB56EBAFA4590
Malicious:	false
Preview:	2024/08/31-08:27:14.822 1dc4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/31-08:27:14.998 1dc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.183876014597277
Encrypted:	false
SSDEEP:	6:usqeq1wkn23oH+Tcwt8aVdg2KLlEsA3+q2Pwkn23oH+Tcwt8aPrqIFUv:dVfYeb0LlRvYfYebL3FUv
MD5:	886B4E52D8A8D5903D3B9EB0388AC1DF
SHA1:	99CDD292C1F5E8527685258018C9CE2E6C13F595
SHA-256:	FB4CBB4901C614189C7C4EF769295CEB014B2A0F9B99E20583AC2DB7CE9C7D81
SHA-512:	DB4F4368C8B7806374D846D20AFAA20C568046398C4880F3F6AD60288474D6578488391EF86FCF02DF42226A2ACB6E96126DFB07B51F2B0FE41DD574EE34DF7E
Malicious:	false
Preview:	2024/08/31-08:27:14.656 1e18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/31-08:27:14.845 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.1379375612946125
Encrypted:	false
SSDEEP:	6:us3h+q1wkn23oH+Tcwt86FB2KLlEsXN+q2Pwkn23oH+Tcwt865IFUv:d3hyfYeb/FFLl4vYfYeb/WFUv
MD5:	63B39415EE6BCD4C63C0A3BC3F416E2D
SHA1:	4851374E4DE2A8ABD1FCB9A1D87F7DECE4C8F213
SHA-256:	B35F6BE55001A7E8253DA991EDDBE04F7F2A430D285D150921BEDECE2087A687
SHA-512:	078A30C5D2AE06326D1F42085B0D37A8486103E19AD147A0165DF2589F6BF07A75619E8E234BB0FFE7EE56C513CF0AE5ABFF11A11A68053323E6EABDE869F388
Malicious:	false
Preview:	2024/08/31-08:27:14.848 1e18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/31-08:27:15.021 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.163461212318024
Encrypted:	false
SSDEEP:	6:uslFyN+q2Pwkn23oH+Tcwt8NIFUt8XsVAEXZmw+XsVAE3VkwOwkn23oH+Tcwt8+Q:dlUIvYfYebpFUt8cx/+cr5JfYebqJ
MD5:	C03D90E2F1C9A7F0856478D374D08E30
SHA1:	AA83E542CD882E17AD363E08077FF6A2EEAA00A6
SHA-256:	33B0B47896B3738E7C57D1DFF189ABB73C216137BB51F9AD0A62416809DE2C9A
SHA-512:	A0986DA32C37EBF17468505F81C364E8CBDE6500177F1A0BF703E3D1E46AA87321D194777687F23C828DD7F753D214F44DBF3EE6BB5BF6B3DCBB4E434A30E58A
Malicious:	false
Preview:	2024/08/31-08:27:15.028 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-08:27:15.029 1e18 Recovering log #3.2024/08/31-08:27:15.029 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.163461212318024
Encrypted:	false
SSDEEP:	6:uslFyN+q2Pwkn23oH+Tcwt8NIFUt8XsVAEXZmw+XsVAE3VkwOwkn23oH+Tcwt8+Q:dlUIvYfYebpFUt8cx/+cr5JfYebqJ
MD5:	C03D90E2F1C9A7F0856478D374D08E30
SHA1:	AA83E542CD882E17AD363E08077FF6A2EEAA00A6
SHA-256:	33B0B47896B3738E7C57D1DFF189ABB73C216137BB51F9AD0A62416809DE2C9A
SHA-512:	A0986DA32C37EBF17468505F81C364E8CBDE6500177F1A0BF703E3D1E46AA87321D194777687F23C828DD7F753D214F44DBF3EE6BB5BF6B3DCBB4E434A30E58A
Malicious:	false
Preview:	2024/08/31-08:27:15.028 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-08:27:15.029 1e18 Recovering log #3.2024/08/31-08:27:15.029 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3272509365592861
Encrypted:	false
SSDEEP:	6:BKaA/J3+t76Y4QZZofU99pO0BYbkqR4EZY4QZvG6n:B2hHQws9LdmBQZG6
MD5:	CC533099A21B055A628617282E3B3C5A
SHA1:	D3D0AF1A1CAC2A2C9740C68A865505E5F578AA1D
SHA-256:	FD82573210BC32DF15E21A62EBCEA6B675ED5A970522D6009C721B117227B543
SHA-512:	30C3F8EA1E517CEBEADEFF0538832DF2DD45E3049E576F629ECCD957A524E17511C26EEA4AD13AAEF44043E2AA48648FB266DD70182DD88F2C37F6BBE86FBD88
Malicious:	false
Preview:	...................'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.275238769526595
Encrypted:	false
SSDEEP:	12:dezvYfYeb8rcHEZrELFUt8cem/+cY5JfYeb8rcHEZrEZSJ:kTYfYeb8nZrExg8n5JfYeb8nZrEZe
MD5:	CD5FFDF7E5DD16633FD77B606CA6E025
SHA1:	E0A7BD1E9D260B80A3CD9F60ECBD6351809EA0D2
SHA-256:	B15AD105E806AA0605A255EEDDAC07614B879CFCBCE804A4BECBC200448DD4BB
SHA-512:	FB20DCE60D075C645D2F7BBA24D9FD62EFE33A9B9F8C11B000A8813C49F58A91138FB4198AAEF0EEF9B42C1E4323EB804117656850E50D38BA02235516DB56F6
Malicious:	false
Preview:	2024/08/31-08:27:15.808 1dc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-08:27:15.808 1dc4 Recovering log #3.2024/08/31-08:27:15.809 1dc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.275238769526595
Encrypted:	false
SSDEEP:	12:dezvYfYeb8rcHEZrELFUt8cem/+cY5JfYeb8rcHEZrEZSJ:kTYfYeb8nZrExg8n5JfYeb8nZrEZe
MD5:	CD5FFDF7E5DD16633FD77B606CA6E025
SHA1:	E0A7BD1E9D260B80A3CD9F60ECBD6351809EA0D2
SHA-256:	B15AD105E806AA0605A255EEDDAC07614B879CFCBCE804A4BECBC200448DD4BB
SHA-512:	FB20DCE60D075C645D2F7BBA24D9FD62EFE33A9B9F8C11B000A8813C49F58A91138FB4198AAEF0EEF9B42C1E4323EB804117656850E50D38BA02235516DB56F6
Malicious:	false
Preview:	2024/08/31-08:27:15.808 1dc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-08:27:15.808 1dc4 Recovering log #3.2024/08/31-08:27:15.809 1dc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.220875414024462
Encrypted:	false
SSDEEP:	6:us9lM+q2Pwkn23oH+Tcwt8a2jMGIFUt8XsXZmw+XsJpMVkwOwkn23oH+Tcwt8a23:d9W+vYfYeb8EFUt8cX/+cJiV5JfYeb8N
MD5:	3394D0A2BA46F60E0FB0BDBDE53AE561
SHA1:	97FA54FE7E33C0AA3E7323CBF69C74013EA01871
SHA-256:	18EF90F2567100839FED62607961074E228852C489CE6EDBA4A72CE19B6DD0A0
SHA-512:	7AB9675D5C705AF930C38832552566B96142832F6F2301288290D036BFE224E1C111BDAC1FEE46A34AA84234B359F853819847FEB4C2FDFBED3E0851B024CE2B
Malicious:	false
Preview:	2024/08/31-08:27:15.592 231c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-08:27:15.593 231c Recovering log #3.2024/08/31-08:27:15.596 231c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.220875414024462
Encrypted:	false
SSDEEP:	6:us9lM+q2Pwkn23oH+Tcwt8a2jMGIFUt8XsXZmw+XsJpMVkwOwkn23oH+Tcwt8a23:d9W+vYfYeb8EFUt8cX/+cJiV5JfYeb8N
MD5:	3394D0A2BA46F60E0FB0BDBDE53AE561
SHA1:	97FA54FE7E33C0AA3E7323CBF69C74013EA01871
SHA-256:	18EF90F2567100839FED62607961074E228852C489CE6EDBA4A72CE19B6DD0A0
SHA-512:	7AB9675D5C705AF930C38832552566B96142832F6F2301288290D036BFE224E1C111BDAC1FEE46A34AA84234B359F853819847FEB4C2FDFBED3E0851B024CE2B
Malicious:	false
Preview:	2024/08/31-08:27:15.592 231c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-08:27:15.593 231c Recovering log #3.2024/08/31-08:27:15.596 231c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\15773a3a-8c46-4e53-aa8b-fa49f0acfdbe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\69f009aa-8616-44b3-90e0-52940efe49bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\88bdd360-9015-45d5-8b3d-6f658fdc800c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2ff74.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3ea90.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d9bc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2e2f3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2ff74.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a61214c8-e593-49c5-b6c5-367bef8a1cd5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dcc12d08-1fca-4cb6-90e1-1ed1016313f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e198b9eb-300b-4b06-9529-160f2ce69939.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ed8e092f-b73e-45e5-bb3b-03a08870fcb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.306421946445174
Encrypted:	false
SSDEEP:	24:YXsOP7ZVMdBsoZFRudFGcs5ZFGJ/dbG7nby:YXsO98s4fcdsvgzbZ
MD5:	3A4779245C60857D5C181F1D37850ACA
SHA1:	8EC820A7DE2373885907FFEB7C41B2DBFF85333E
SHA-256:	B62D15984C99D48C787C51D441CA442EF35B486604BC2D42A1AE3BC021433BA2
SHA-512:	1661FFEBE6CBC20F5460F0508EA50A8F763D5BA295B734E0440B457E0624AD948D93EDA8C086756DB50B8378747CDD37CBF9D358A567B445D3393E8D8D77E903
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372172836492749","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372172837609119","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372172839970285","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0679394893191185
Encrypted:	false
SSDEEP:	96:sVgYqlLJ1gb9s79a2xYuXEmn0Y2sY5Th6Cp9/x+6M8muecmAeC5e4zvrM2X6gE5F:sVgY0JLa2xPUmn0Y2sYPpj+FVA9MFBf
MD5:	182B71011E294C7C40E56154C65401B5
SHA1:	3DFC1468B906FFB97B4621AA7846A01F616AA52B
SHA-256:	9042F3F3B3384B856EEA7311A32A558B98EA4BB3074B2278BD4E1F24825F60AA
SHA-512:	A91BCEE3599D1F43179941C24C9B703BFB10A8ED94703798C573CC4D5ADFC3AC6D30DC661359989D37E03FBCACF95476799A9F6817A2BC18F90607EBB312DF3F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369580834854035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF351ea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0679394893191185
Encrypted:	false
SSDEEP:	96:sVgYqlLJ1gb9s79a2xYuXEmn0Y2sY5Th6Cp9/x+6M8muecmAeC5e4zvrM2X6gE5F:sVgY0JLa2xPUmn0Y2sYPpj+FVA9MFBf
MD5:	182B71011E294C7C40E56154C65401B5
SHA1:	3DFC1468B906FFB97B4621AA7846A01F616AA52B
SHA-256:	9042F3F3B3384B856EEA7311A32A558B98EA4BB3074B2278BD4E1F24825F60AA
SHA-512:	A91BCEE3599D1F43179941C24C9B703BFB10A8ED94703798C573CC4D5ADFC3AC6D30DC661359989D37E03FBCACF95476799A9F6817A2BC18F90607EBB312DF3F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369580834854035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e34c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0679394893191185
Encrypted:	false
SSDEEP:	96:sVgYqlLJ1gb9s79a2xYuXEmn0Y2sY5Th6Cp9/x+6M8muecmAeC5e4zvrM2X6gE5F:sVgY0JLa2xPUmn0Y2sYPpj+FVA9MFBf
MD5:	182B71011E294C7C40E56154C65401B5
SHA1:	3DFC1468B906FFB97B4621AA7846A01F616AA52B
SHA-256:	9042F3F3B3384B856EEA7311A32A558B98EA4BB3074B2278BD4E1F24825F60AA
SHA-512:	A91BCEE3599D1F43179941C24C9B703BFB10A8ED94703798C573CC4D5ADFC3AC6D30DC661359989D37E03FBCACF95476799A9F6817A2BC18F90607EBB312DF3F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369580834854035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558217615408309
Encrypted:	false
SSDEEP:	768:5ENtOw7pLGLvAxWPrnf1s8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtstQirwuipbtuZ:5ENtO8cvAxWPrnf1su1jaQCQHuitO
MD5:	BC2734750F5790FCC7AF0BA5CC560FAE
SHA1:	826AF4CCCAF635EAA42D4481752912D9796D3630
SHA-256:	18E252E72EFFFBAAB0A65453AEE01E2A8C6928DD32996B4CAEDED9EFDD77A6CB
SHA-512:	DCD19DBAAC9C0981CC502BDA9AF9FE98A5CDD9BA9A4D35B28DD5DEB9F77EA8323EF2EE189FC4CB61CCD3680218910A36AE8968BDF8282B71A2222E0FEB9176D5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369580834629904","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369580834629904","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF337f9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558217615408309
Encrypted:	false
SSDEEP:	768:5ENtOw7pLGLvAxWPrnf1s8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtstQirwuipbtuZ:5ENtO8cvAxWPrnf1su1jaQCQHuitO
MD5:	BC2734750F5790FCC7AF0BA5CC560FAE
SHA1:	826AF4CCCAF635EAA42D4481752912D9796D3630
SHA-256:	18E252E72EFFFBAAB0A65453AEE01E2A8C6928DD32996B4CAEDED9EFDD77A6CB
SHA-512:	DCD19DBAAC9C0981CC502BDA9AF9FE98A5CDD9BA9A4D35B28DD5DEB9F77EA8323EF2EE189FC4CB61CCD3680218910A36AE8968BDF8282B71A2222E0FEB9176D5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369580834629904","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369580834629904","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.142493420130438
Encrypted:	false
SSDEEP:	6:usKM+q2Pwkn23oH+TcwtrQMxIFUt8XsOXZmw+XsmjMVkwOwkn23oH+TcwtrQMFLJ:dX+vYfYebCFUt8ce/+cmwV5JfYebtJ
MD5:	951C0FECA704B4FCC92E5CCF792B9C39
SHA1:	3D8A3D2A0742DC38FB35F4BB88ACB638D927EE34
SHA-256:	1A8D5225E00A9379327144417EC3AA265B171C132E3D4FB35EF7DB06039EB391
SHA-512:	B47C2A6DD63804A0DE8AFE43896D619493025CDC1225D9A88882C45FB73F783E75060879DF7CFD7DF251BF3B88CD1EA178CEE73C2E8A549B2837F8B95B4FEC2A
Malicious:	false
Preview:	2024/08/31-08:27:30.806 231c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-08:27:30.809 231c Recovering log #3.2024/08/31-08:27:30.815 231c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.142493420130438
Encrypted:	false
SSDEEP:	6:usKM+q2Pwkn23oH+TcwtrQMxIFUt8XsOXZmw+XsmjMVkwOwkn23oH+TcwtrQMFLJ:dX+vYfYebCFUt8ce/+cmwV5JfYebtJ
MD5:	951C0FECA704B4FCC92E5CCF792B9C39
SHA1:	3D8A3D2A0742DC38FB35F4BB88ACB638D927EE34
SHA-256:	1A8D5225E00A9379327144417EC3AA265B171C132E3D4FB35EF7DB06039EB391
SHA-512:	B47C2A6DD63804A0DE8AFE43896D619493025CDC1225D9A88882C45FB73F783E75060879DF7CFD7DF251BF3B88CD1EA178CEE73C2E8A549B2837F8B95B4FEC2A
Malicious:	false
Preview:	2024/08/31-08:27:30.806 231c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-08:27:30.809 231c Recovering log #3.2024/08/31-08:27:30.815 231c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.15844335766474
Encrypted:	false
SSDEEP:	6:usIuw0Vq2Pwkn23oH+Tcwt7Uh2ghZIFUt8XsIuw0gZmw+XsIuw0IkwOwkn23oH+Q:dZVvYfYebIhHh2FUt8cZg/+cZI5JfYeQ
MD5:	7A4AEA85DC8C10E22D8C262BF2FF400F
SHA1:	53BFC8AF0755108734DA393E9E7954D0DB0DCFF9
SHA-256:	774F8A55CD6DF48348D036D0A8D7B3C93B02C2AAF0E5F2AEB54B0EDCBB1A4BFC
SHA-512:	B8767D700C9F003ADAA2191386CEE7D704D64BE88ED51B085D73AE90F9EE1DDCF0585656D8F3651A00213C3487519F41F5D3A47F0E5075DF4D092B3317C433CA
Malicious:	false
Preview:	2024/08/31-08:27:14.640 1dc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-08:27:14.640 1dc4 Recovering log #3.2024/08/31-08:27:14.640 1dc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.15844335766474
Encrypted:	false
SSDEEP:	6:usIuw0Vq2Pwkn23oH+Tcwt7Uh2ghZIFUt8XsIuw0gZmw+XsIuw0IkwOwkn23oH+Q:dZVvYfYebIhHh2FUt8cZg/+cZI5JfYeQ
MD5:	7A4AEA85DC8C10E22D8C262BF2FF400F
SHA1:	53BFC8AF0755108734DA393E9E7954D0DB0DCFF9
SHA-256:	774F8A55CD6DF48348D036D0A8D7B3C93B02C2AAF0E5F2AEB54B0EDCBB1A4BFC
SHA-512:	B8767D700C9F003ADAA2191386CEE7D704D64BE88ED51B085D73AE90F9EE1DDCF0585656D8F3651A00213C3487519F41F5D3A47F0E5075DF4D092B3317C433CA
Malicious:	false
Preview:	2024/08/31-08:27:14.640 1dc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-08:27:14.640 1dc4 Recovering log #3.2024/08/31-08:27:14.640 1dc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulI+p/:LstQ/
MD5:	85F946B9AEC0A9F94B489575EB508598
SHA1:	8CBD92036984B25BE172342E82FE2BC6F5353560
SHA-256:	2C58CD70B5F471FE613044BAEBCDC6AC2D2879237790154E93FF1837C8928F16
SHA-512:	37F30C8008658DD92CD49488F3FC024E509B7F8D7C43908FB9D7E4366EF5A003F7960CAACE2A87F666641FC07CADA62FD696225FE4AC4E0B09C92D0FA595BEA6
Malicious:	false
Preview:	........................................?...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlwQKX:Ls3/KX
MD5:	CEEE6CE1D90853C31E846545AA49B893
SHA1:	52F4F2E8F95D8CB5443779EB5F40B0BA3775A7DB
SHA-256:	F78261297DA35167A6EF49AF7A9749FB01C46431C9E3D7102FE3012BC795C757
SHA-512:	E889BED32A42D4B32B56307EDA6CE430EFD21EF982D6423A8B84B324DE48527BF8B4CAF08ED61A01AA7C24F531F815C779962B4E685CBA0582D8E177F5DA6A7A
Malicious:	false
Preview:	........................................{Ey.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.269669625734408
Encrypted:	false
SSDEEP:	12:d3+vYfYebvqBQFUt8ca//+cM3V5JfYebvqBvJ:mYfYebvZg8nIJfYebvk
MD5:	342D9F602955CC9D9E55A33BC1AF7FE6
SHA1:	89DBAA88321BA2BE948BCBA07BCEB14B108F0C1C
SHA-256:	861B11048C312CA2768DDF3BD9F32FF44F2EECD796BA126B8BADA4782525D5B5
SHA-512:	D707238DBD8EF6B18493ED9A8BAFE5974BBA475D4B12FED39A252E48F285DE19AF13240DB66BA59E99F00B5BCA5B299BB2301DCCB883A501B827EF046A805694
Malicious:	false
Preview:	2024/08/31-08:27:15.607 231c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-08:27:15.608 231c Recovering log #3.2024/08/31-08:27:15.611 231c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.269669625734408
Encrypted:	false
SSDEEP:	12:d3+vYfYebvqBQFUt8ca//+cM3V5JfYebvqBvJ:mYfYebvZg8nIJfYebvk
MD5:	342D9F602955CC9D9E55A33BC1AF7FE6
SHA1:	89DBAA88321BA2BE948BCBA07BCEB14B108F0C1C
SHA-256:	861B11048C312CA2768DDF3BD9F32FF44F2EECD796BA126B8BADA4782525D5B5
SHA-512:	D707238DBD8EF6B18493ED9A8BAFE5974BBA475D4B12FED39A252E48F285DE19AF13240DB66BA59E99F00B5BCA5B299BB2301DCCB883A501B827EF046A805694
Malicious:	false
Preview:	2024/08/31-08:27:15.607 231c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-08:27:15.608 231c Recovering log #3.2024/08/31-08:27:15.611 231c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\56867403-1d56-43bf-bf86-85a92203981c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\698ebe66-acc9-4016-800a-f16c73d4a6ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9b95d18f-12ca-4bc1-bd38-0bbaf1fb49be.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3fbe5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2e2f3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a77d6d15-71f4-4116-a95a-583a8ebdf564.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.265396345939547
Encrypted:	false
SSDEEP:	12:dhvYfYebvqBZFUt8cf/+cK5JfYebvqBaJ:fYfYebvyg8zJfYebvL
MD5:	A0B5C881021AB17BB1191AB6A4941F1E
SHA1:	1C11D10F85BCD7BE84129946244B3A7E973DF1D2
SHA-256:	151BE724D4CA022FBA36012FDA3658CD78983CE8A2A33EBC7BBE5FF75DC246B4
SHA-512:	F3E87A50DA12B8606D92F647185B5D6F96E7DD80C07BB69B7BF073797357E446694475B99C46FEC81F7A7EE1120FB5E6FA5E7CBF06B593B7A079204D6127F135
Malicious:	false
Preview:	2024/08/31-08:27:30.806 194 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-08:27:30.809 194 Recovering log #3.2024/08/31-08:27:30.817 194 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.265396345939547
Encrypted:	false
SSDEEP:	12:dhvYfYebvqBZFUt8cf/+cK5JfYebvqBaJ:fYfYebvyg8zJfYebvL
MD5:	A0B5C881021AB17BB1191AB6A4941F1E
SHA1:	1C11D10F85BCD7BE84129946244B3A7E973DF1D2
SHA-256:	151BE724D4CA022FBA36012FDA3658CD78983CE8A2A33EBC7BBE5FF75DC246B4
SHA-512:	F3E87A50DA12B8606D92F647185B5D6F96E7DD80C07BB69B7BF073797357E446694475B99C46FEC81F7A7EE1120FB5E6FA5E7CBF06B593B7A079204D6127F135
Malicious:	false
Preview:	2024/08/31-08:27:30.806 194 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-08:27:30.809 194 Recovering log #3.2024/08/31-08:27:30.817 194 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.203480155991902
Encrypted:	false
SSDEEP:	6:ustQL+q2Pwkn23oH+TcwtpIFUt8XsZDSG1Zmw+XsZDSQLVkwOwkn23oH+Tcwta/o:diyvYfYebmFUt8cZj/+cZ/R5JfYebaUJ
MD5:	7052C6F08FBF3E791866D1E72638E248
SHA1:	8A3ECC9E6CA5F2247C97639C2E43B44AEC231CF7
SHA-256:	023156E0853248D70F8867818E020F385DDDB4D5F4D1935BC7155E8CD4721AF2
SHA-512:	FC719FF76163ECCEA9A90571157580C85A2CFC97AF6AAA0EAD33C3DDCE2F09D0941BD72C557025A60FD734DED4C10BB66FF0CCAF723A7BF9B6ED9A0F045FB12A
Malicious:	false
Preview:	2024/08/31-08:27:14.826 14a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-08:27:14.827 14a8 Recovering log #3.2024/08/31-08:27:14.827 14a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.203480155991902
Encrypted:	false
SSDEEP:	6:ustQL+q2Pwkn23oH+TcwtpIFUt8XsZDSG1Zmw+XsZDSQLVkwOwkn23oH+Tcwta/o:diyvYfYebmFUt8cZj/+cZ/R5JfYebaUJ
MD5:	7052C6F08FBF3E791866D1E72638E248
SHA1:	8A3ECC9E6CA5F2247C97639C2E43B44AEC231CF7
SHA-256:	023156E0853248D70F8867818E020F385DDDB4D5F4D1935BC7155E8CD4721AF2
SHA-512:	FC719FF76163ECCEA9A90571157580C85A2CFC97AF6AAA0EAD33C3DDCE2F09D0941BD72C557025A60FD734DED4C10BB66FF0CCAF723A7BF9B6ED9A0F045FB12A
Malicious:	false
Preview:	2024/08/31-08:27:14.826 14a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-08:27:14.827 14a8 Recovering log #3.2024/08/31-08:27:14.827 14a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:dtHl1lhtlLa:nH3m
MD5:	38C20E07C223FDC83B5C10E5110FA7FC
SHA1:	03F1C2B771ABA8CA6A537866D2CA7DCF4F571CED
SHA-256:	E634DCC95ED4A7596C187C2542E65586E6920B7EC79BE427D56439D0E68FD1EF
SHA-512:	E534354CF1FF97C13FE0EA6D234DD4051574977B66F352E2B24190B09ACD5E8817037CECE7D225FC76938B40605E5307AF04C0F4EF70962CB0E9F5606310708F
Malicious:	false
Preview:	............Emh....W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d54d8345-4734-48d6-ba3f-d9483fb92086.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0679394893191185
Encrypted:	false
SSDEEP:	96:sVgYqlLJ1gb9s79a2xYuXEmn0Y2sY5Th6Cp9/x+6M8muecmAeC5e4zvrM2X6gE5F:sVgY0JLa2xPUmn0Y2sYPpj+FVA9MFBf
MD5:	182B71011E294C7C40E56154C65401B5
SHA1:	3DFC1468B906FFB97B4621AA7846A01F616AA52B
SHA-256:	9042F3F3B3384B856EEA7311A32A558B98EA4BB3074B2278BD4E1F24825F60AA
SHA-512:	A91BCEE3599D1F43179941C24C9B703BFB10A8ED94703798C573CC4D5ADFC3AC6D30DC661359989D37E03FBCACF95476799A9F6817A2BC18F90607EBB312DF3F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369580834854035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ea8134b6-324d-487b-9eea-4ef7ea2eeb8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.291939891407381
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQyVlvl/l3seGKT9rcQ6xnJNEOtlTxotl:/XntM+Plvl/l3sedhOJNEOu
MD5:	EEE35FED85FBC5CC04AAF083F9C646EE
SHA1:	BDDE0579DCA187D2FE6CB3E4215E06624A2C35EF
SHA-256:	663BC5EBB1273F40D48978B29BC4F1D4CB44A199A3D5D555B60A079727B4D564
SHA-512:	F1FB551485E4FE0B6B83DE7687A8830B64BB462CEF1BF83626F4DF9D1008CE8C37F9A8B982794400A26956064B9B82CBE812EA89AAF795240A85619B3E7BC8DA
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1(...0................39_config..........6.....n ....1u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.236980531868565
Encrypted:	false
SSDEEP:	6:usEs1wkn23oH+Tcwtfrl2KLlEs43+q2Pwkn23oH+TcwtfrK+IFUv:dEfYeb1Ll43+vYfYeb23FUv
MD5:	77503987FBA76D087A0E1FCCD4A6DCBD
SHA1:	2A3ED1B8E6AB1AE697F6928ED9E43990E46A3732
SHA-256:	0B9EA308A338768C39106FD2677B3C781F7A694912BD092E35F6FC8A2A346AAA
SHA-512:	6CBFE4B895D31C47F0522EB93F5150A0D926D9B0B5E3648D25CCFDB4624B5A8F0D899FF03EB79B43E0AEF2B51975B538401096B250A0BFF5C6C8BE2C93B06FA7
Malicious:	false
Preview:	2024/08/31-08:27:14.877 1dec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/31-08:27:15.316 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	646
Entropy (8bit):	3.9120498699710926
Encrypted:	false
SSDEEP:	12:G0nYUtTNVdZ5zD/7bEXZmh/U/9Y+chRc9izk6Uu9:G0nYUtP35zDjomhCe+c1zk6h9
MD5:	238E9B114B0A78614986C64215A241E4
SHA1:	553BAFA8663EF74AEADA837BA631365CF08BD631
SHA-256:	77C0FAF7AF9D682DC55F0DDC4581FE7AE8F402DC52B2D2D120DD88AA50BAF3D0
SHA-512:	6533BF1025868406B8B07B2B3FFCDC539ECB6F4A85C69B00F45E60494D52C86D292F4BB9F98C67170AE5600A51875FDC5972BDEADDEEAC2D995A008A14C30852
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....'...................20_.......T=.................19_.....*...................18_........a.................37_......x...................38_........i.................39_.........................20_........].................20_.....{a...................19_.....f.F..................18_.......\|.................37_.......&B.................38_........D.................39_..........................9_......y(.................21_..........................21_.....JJ...................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.195909146139015
Encrypted:	false
SSDEEP:	6:usOD1wkn23oH+Tcwtfrzs52KLlEsqA+q2Pwkn23oH+TcwtfrzAdIFUv:dhfYebs9LlqA+vYfYeb9FUv
MD5:	885B1D0D15098652AB2C4F451745734E
SHA1:	FDCE9313935752866CF080DB5FC7039BA2025AA6
SHA-256:	30A446B2B76BA652CE195A9BBAD44EC54898AA56221D835C30B1450A54732CF4
SHA-512:	1818062A89393884A8D5AE259105E1291C6C90F0AC9914B12FF0FE75808DB94472FBFC0A4FCA30B42FF56C17C138C9697DDE6EAEDC652C1BA8029C54E430B83B
Malicious:	false
Preview:	2024/08/31-08:27:14.863 1dec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/31-08:27:14.875 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNljrBX:Ls3PBX
MD5:	D4649A2BB3F60B33C792ADCBC57B6B95
SHA1:	C547A5FC7F9BFAE64091C4CDBE8F2E79CF47348B
SHA-256:	64281CD8AF62B8812FA8C56D331CC320B050D6BF143DE7048C797F0D90E69404
SHA-512:	94B73B0207C67C3A2177AD2CE92D8BD610C7155D297173ADB94CEF9F06A6C87E9FEED1DFE0F1E53AF5850929EAF2DA61BC0CD65440C24123B673E923EDFAC5E3
Malicious:	false
Preview:	.........................................K..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlpq:Ls3pq
MD5:	538250D1765A05FF25A7DF48FEB7238F
SHA1:	94162C82BBCED3BAB7197B1786E452A5D0293B65
SHA-256:	DF8197474AE544923C6FD7F0F746ADBF25167D3FE284EFEDEB10041C152BDDCB
SHA-512:	1EA505C85674F7E01DC9FD5A0FF74A233681F207C509D0CC8A0B734052291B4FC4A3896AFA721748131DFC4731F695259EE4A519697840978201E5BF6A1666A8
Malicious:	false
Preview:	........................................@..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d1dc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d23a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f17a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f199.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f1d8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f1e8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF311a5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF311b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF344bb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF344ca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bc1d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e31e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF43286.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792896265067085
Encrypted:	false
SSDEEP:	96:iaqkHf1qH75ih/cI9URLl8RotoJMFVvlwh7e4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akNqHceiRUah96qRAq1k8SPxVLZ7VTiq
MD5:	20CA4A0955896D5418D6D6BAC684408D
SHA1:	242D370AED54DC8BC9AB9FA4C8166A9AE8DC5A9C
SHA-256:	48BFCAC1019C30EE2BEAC6894696E59565F123A89FC1C6F2D1660EE0C9CEDDA3
SHA-512:	0DDCD36C5C28FC3ECEC6EDD0BDED821E9648D0302B4DC92014DB5AC24B37B02115CB3AB05C2EAA03FFD0063B0E0A7D52E8C5A063915AF3028C8D531536D8973C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAACxwgnEPBXRqslBJQy62WgEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAPPqHxwr8x11QcLGQ0SZbcLNynqRG507jIOKdUVRjfdQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlZ3/:Ls3Z3/
MD5:	41220B02413D12C5F7C0474BEF56ED55
SHA1:	FA78208E59F41177B422406C490623B692313E3C
SHA-256:	6445328149A21DF0A152D93E1A33D7255694D0B25271A098019AC870E05AC194
SHA-512:	B9D7F4113854D1BEC76FD7BEF631D83EF89CF8E0F3C41338198C497ECA5F6C99B4C088E448EB23A2F23C271C14373D8E97765E9D96D73BF77B3B3742EA092B74
Malicious:	false
Preview:	........................................+.p.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ad56895a-8336-416a-8dea-db5096d0060e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.799629583214716
Encrypted:	false
SSDEEP:	192:fsNwNqH8eiRUhdQWkRW6qRAq1k8SPxVLZ7VTiQ:fsNwBYilRW6q3QxVNZTiQ
MD5:	A64109FBC1EF291087E9EF6497A185C7
SHA1:	4768256F8E141175B6681393400D3B7732368A72
SHA-256:	C039F7B95C166E6ED2858B05D04C427B441546B9AE3EDB3C6050869D8361C41F
SHA-512:	386D66EE7833A153F090A0F35B1CFB01A6418C0157F9221234BB224CACDF729B6A28DDF8619921CE385F1F1CA158BFB506B226DF0B1FE90ECE298992A1EC164A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c69efd95-8f97-413f-8885-619d1e5819c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.833581225721611
Encrypted:	false
SSDEEP:	192:fsNwNqH8eiRUhi1kQ568jHmkRf96qRAq1k8SPxVLZ7VTiB:fsNwBYCj5FH1Rf96q3QxVNZTiB
MD5:	11192840054A71D673D9C188FB8816F4
SHA1:	C8D7A16717AFBF97D8B450CE6285E638CB765234
SHA-256:	B832093742A35761FBDD14A12F7A61F1CA8A1599D052BC74434DA0A7E8E3964E
SHA-512:	5CA8BF54EF0CAFBC2519BBCF1370E37815E467BDBFF70BF19BAF5B0F87655C8DEE27A00589B2664F6E7160627CC582EA341E6A705070421E11459BEE9A5217F8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dc5c94bd-41cb-4468-b495-dfa2cf3aa4b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.833667126658018
Encrypted:	false
SSDEEP:	192:fsNwNqH8eiRUhi1kQ56LynkRf96qRAq1k8SPxVLZ7VTiB:fsNwBYCj5ZkRf96q3QxVNZTiB
MD5:	1BED8C818599E70EC9A99DB07A618945
SHA1:	8D92657A4DD305DD5E2E78567339B18E12522940
SHA-256:	550B46A2CE472C7469C54CEE701FA01036D94FD160EE1A0E87F2DA317D7A8459
SHA-512:	395B46D3C6061A24B3B9E74AB24DB2A86989F43FA20384F25521EC829CB36B134DF8422FE314C8F914F60C6C77995BB6C03B9806E99F7062C19C0FD4A3CA44E8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8376154653744097
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxsxl9Il8udmluVXWP2wPuSwwGDmvDd1rc:mxY6luVWPTSwKsk
MD5:	3B53F3346287C0BB5358A6836A4450E3
SHA1:	02BDD584C5DBF6437DF98E0BDDA2A9DA522B3C5B
SHA-256:	12CF5407156A571CBC616C2F53E7C287F880EBABB6C7ACC8E5075364D058ECD4
SHA-512:	F22F6A71E28049E5EC9740B0931CC70C0C277DC3B7580E70D2968D0F139C2843C08E84B46060DB0C0424E3230AA5BD63F8B85F5BA6303BDDEC2BBF54791964EB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.H.1.L.d.K.n.7.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.A.s.c.I.J.x.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9977130567517363
Encrypted:	false
SSDEEP:	96:aY6lkQsPMXVlyMQlJt0QBXlm8N+dfaty3PgFj:aWMXKtVXsy
MD5:	B994CDCC49813FC8CB87403586E7690A
SHA1:	C2F473EB84C9C085AF7AEA07F702CE8378996322
SHA-256:	40ED6D5975C4E88994D7AF0B0E01E0FD324C43FB7E7B60B58541E2E35D483B13
SHA-512:	D8E5DC8193248D7BF07D4AC3A67F73C0BCAFC26286BD1C6B3BCA8BDB94F1D4190890CF82962468B90CA5423F55D4D9D6148E616A76EBD8156DA1F982346AE240
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".4.6.1.4.W.q.H.7.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.A.s.c.I.J.x.

C:\Users\user\AppData\Local\Temp\0f0c5b87-7ccf-424c-8c20-82cc8f3f55dd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\8d9beeb4-93ea-4475-9001-ed18ae41761d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\bfe1d4b2-77e8-45ae-8a64-0f7caff4d22a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.380624852257647
Encrypted:	false
SSDEEP:	12:YpYl3u0Dkv/PYH1q56s/PYH1x3rqu0Dkv/PYytNKMr56s/C:Ypqe08Gq5xG1708ptNVr5M
MD5:	62FD0330B73898CCDC70EB0F4F7A1448
SHA1:	BECF55F7CEE0AEC3CBE1B0D5EE0F2885F99DB683
SHA-256:	EFD692ADB5D6DE7F81A638324BD61F15C2822934557A81EBF408C88DD1A743AE
SHA-512:	F743F68627A13C6414E72D0DB7420F8A238DADCCEBE5C6E641F6A144EF158075020C76979E6E5C3C74E7B62EC2A0B50BEC42DB0ED3C529483DBECCC4C417FA67
Malicious:	false
Preview:	{"logTime": "0831/122701", "correlationVector":"F0BAED597A2B407A96FDB96E8C68FC81","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0831/122716", "correlationVector":"pGhB5mvvbem0ZOvnuuzkpO","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0831/122716", "correlationVector":"E694B1E4B8494A17A644C316EBF613D2","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0831/122717", "correlationVector":"Ejgl2VTz9fs7Cz4ddkR69K","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\e1990ff9-907e-45d8-8a30-80bbd412cdd7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8620_2077904688\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8620_2077904688\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8620_2077904688\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8620_2077904688\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_2077904688\bfe1d4b2-77e8-45ae-8a64-0f7caff4d22a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\8d9beeb4-93ea-4475-9001-ed18ae41761d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8620_360532724\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2T7EPE3X0M9ZOKB49VHZ.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.4938644009428237
Encrypted:	false
SSDEEP:	48:WEJ1bdOrkKsJrr2yzBdLXuH/kDpc2AJ1bdOrkKsJrr2yzngdLXuH/k+21:2S3ufkDzDSnIufkz
MD5:	F3C279606C3139C2B214A765D23D5AE4
SHA1:	7321A149AD5715C50FA8C0B8C3BAE5CC72840B41
SHA-256:	54434945A698FABBFABB321EA0D468C200CCCED024F420DEED74595493B5BECB
SHA-512:	04DB02B2A0EF99969AF6FE5FB096146FAC6E3E13141C84B763423559FC8BB9020A4E33142BADBE0814B3877FA7C1330457FF2130344164DCFF1D9ABABB4C1B7D
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...>.(......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......YZc..PROGRA~2.........O.I.YZc....................V.....]p..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y\c..........................8Un.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Yac...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y\c..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y\c....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............@.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.4984832128734826
Encrypted:	false
SSDEEP:	48:WEtRdOreKsJrr2yzBdLXuH/kDpc2AJ1bdOrkKsJrr2yzngdLXuH/k+21:US3ufkDzDSnIufkz
MD5:	3226CFB998CDA271288056E1471643F2
SHA1:	38F776E2B4AA8335E57FAF13FD7439740C54B9B8
SHA-256:	188C719CB96F3D0087D2665992DF1E547E56967812E4A373524987485206EF2F
SHA-512:	BCDBF8AF3786904217A23E815F464F18F18E1796267FA12B60E50AE1B92DCA4273D87DFC2CD4D41FC83D1C5666A77FF93A82F041C3F105B369B7431C2F972746
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...>.(......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V......1).P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y\c..........................8Un.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y\c..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y\c....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............@.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LIJS0KSNHPEJW5MWPT7V.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.4984832128734826
Encrypted:	false
SSDEEP:	48:WEtRdOreKsJrr2yzBdLXuH/kDpc2AJ1bdOrkKsJrr2yzngdLXuH/k+21:US3ufkDzDSnIufkz
MD5:	3226CFB998CDA271288056E1471643F2
SHA1:	38F776E2B4AA8335E57FAF13FD7439740C54B9B8
SHA-256:	188C719CB96F3D0087D2665992DF1E547E56967812E4A373524987485206EF2F
SHA-512:	BCDBF8AF3786904217A23E815F464F18F18E1796267FA12B60E50AE1B92DCA4273D87DFC2CD4D41FC83D1C5666A77FF93A82F041C3F105B369B7431C2F972746
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...>.(......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V......1).P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y\c..........................8Un.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y\c..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y\c....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............@.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.4938644009428237
Encrypted:	false
SSDEEP:	48:WEJ1bdOrkKsJrr2yzBdLXuH/kDpc2AJ1bdOrkKsJrr2yzngdLXuH/k+21:2S3ufkDzDSnIufkz
MD5:	F3C279606C3139C2B214A765D23D5AE4
SHA1:	7321A149AD5715C50FA8C0B8C3BAE5CC72840B41
SHA-256:	54434945A698FABBFABB321EA0D468C200CCCED024F420DEED74595493B5BECB
SHA-512:	04DB02B2A0EF99969AF6FE5FB096146FAC6E3E13141C84B763423559FC8BB9020A4E33142BADBE0814B3877FA7C1330457FF2130344164DCFF1D9ABABB4C1B7D
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...>.(......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......YZc..PROGRA~2.........O.I.YZc....................V.....]p..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y\c..........................8Un.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Yac...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y\c..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y\c....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............@.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579772171869098
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	29517e92d7761860f63fc179b031172d
SHA1:	fee8246f3841238774132287ff9645fd240da0ce
SHA256:	c480a41460d45f0d11873a8b273b4193a270d3a4ed28c5653b566fc8ea06b680
SHA512:	4062d2225b19a3d72ed48850bf504bd32726a89a23a10c280d1e4f912826688dff5a4b3bd80131e7c473752b782d8f0f9c0b8104baeb13b4949ba3b29c047f8a
SSDEEP:	12288:ZqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTY:ZqDEvCTbMWu7rQYlBQcBiT6rprG8asY
TLSH:	FC159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D30B1A [Sat Aug 31 12:22:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FE03108C223h
jmp 00007FE03108BB2Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FE03108BD0Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FE03108BCDAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FE03108E8CDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FE03108E918h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FE03108E901h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	059d5cc9e9ce1b74959267ed92015515	False	0.2869010416666667	data	5.1654960784302855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 14:26:50.787645102 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 31, 2024 14:27:00.460092068 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 31, 2024 14:27:01.852888107 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.852917910 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.852935076 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:01.852943897 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:01.853022099 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.853135109 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.853499889 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:01.853499889 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.853508949 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:01.853527069 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:01.853609085 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:01.853945971 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.853960037 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:01.853996038 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:01.854007006 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:01.854296923 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.854305029 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:01.854676962 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.854803085 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.854815006 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:01.965828896 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.965852976 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:01.965923071 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.966573954 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:01.966594934 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.198039055 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.198077917 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.198457003 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.198457003 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.198491096 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.212090015 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.212111950 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.212291956 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.212418079 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.212434053 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.313308001 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:02.315754890 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.316375017 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.317471981 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.348865032 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.348876953 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.349206924 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.349215984 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.349241018 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.349248886 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.349657059 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:02.349670887 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:02.349736929 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.349858999 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.350126982 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.350157976 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.350187063 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.350298882 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.350578070 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:02.350651026 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:02.365329027 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:02.365391970 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:02.367475033 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.367553949 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.367671013 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:02.367677927 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:02.368315935 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.368376017 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.368824959 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.368905067 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.369210005 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.369215965 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.369394064 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.369406939 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.369514942 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.369528055 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.413177967 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:02.413177967 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.413183928 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.413183928 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.437542915 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.445115089 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.445130110 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.446135998 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.446224928 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.447313070 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.447370052 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.447567940 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.447576046 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.466254950 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:02.466315985 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:02.466615915 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:02.468826056 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.468880892 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.469526052 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.469583988 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.469593048 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.469671965 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.470434904 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.470487118 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.470526934 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.471822977 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.471837044 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.472052097 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.472055912 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.472377062 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.472395897 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.473211050 CEST	49749	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:02.473217010 CEST	443	49749	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:02.490571022 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.575001001 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.575040102 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.575129032 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.724884987 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.724914074 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.725006104 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.726376057 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.726385117 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.759473085 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.759488106 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.799709082 CEST	49756	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.799767017 CEST	443	49756	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.799827099 CEST	49756	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.800000906 CEST	49757	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.800024986 CEST	443	49757	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.800101042 CEST	49757	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.800215006 CEST	49756	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.800234079 CEST	443	49756	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.800401926 CEST	49757	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.800414085 CEST	443	49757	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:02.835616112 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.845947027 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.845972061 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.846265078 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.846468925 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.846492052 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.846846104 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.846911907 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.847723961 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.847796917 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.848489046 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.848537922 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.848582029 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.848656893 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.848745108 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.848753929 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.848803997 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.848809958 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.896809101 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.896810055 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.947722912 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.947745085 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.947751999 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.947776079 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.947797060 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.947804928 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.947829962 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.947832108 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.947849989 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.947874069 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.948844910 CEST	49753	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.948857069 CEST	443	49753	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.949387074 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.949408054 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.949414015 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.949439049 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.949453115 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.949456930 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.949472904 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.949482918 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:02.949511051 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:02.949521065 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.035465956 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.035486937 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.035528898 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.035537004 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.035562992 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.035578012 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.046925068 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.046940088 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.046997070 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.047005892 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.047044992 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.069107056 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.069129944 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.069253922 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.069432020 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.069463015 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.069545984 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.069606066 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.069621086 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.069714069 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.069727898 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.122912884 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.122929096 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.122988939 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.122997999 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.123034954 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.123148918 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.123195887 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.123198032 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.123244047 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.139293909 CEST	49752	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:03.139317036 CEST	443	49752	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:03.213578939 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.213911057 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.213924885 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.214374065 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.214663029 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.214746952 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.214787006 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.253763914 CEST	443	49757	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.254002094 CEST	49757	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.254010916 CEST	443	49757	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.254318953 CEST	443	49757	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.254592896 CEST	49757	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.254652023 CEST	443	49757	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.254695892 CEST	49757	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.256202936 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.256210089 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.271495104 CEST	443	49756	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.271689892 CEST	49756	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.271709919 CEST	443	49756	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.272048950 CEST	443	49756	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.272356987 CEST	49756	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.272419930 CEST	443	49756	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.300499916 CEST	443	49757	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.303075075 CEST	49757	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.318692923 CEST	49756	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.332866907 CEST	49760	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.332892895 CEST	443	49760	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.332967997 CEST	49760	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.332989931 CEST	49761	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.333009958 CEST	443	49761	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.333077908 CEST	49761	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.333097935 CEST	49762	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.333103895 CEST	443	49762	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.333141088 CEST	49762	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.333328009 CEST	49760	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.333340883 CEST	443	49760	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.333451986 CEST	49761	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.333463907 CEST	443	49761	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.333550930 CEST	49762	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.333561897 CEST	443	49762	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.336071968 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.336133003 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.336184025 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.336258888 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.336271048 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.393563032 CEST	443	49757	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.393614054 CEST	443	49757	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.393668890 CEST	49757	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.393853903 CEST	49757	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.393860102 CEST	443	49757	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.511013031 CEST	49764	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:03.511059046 CEST	443	49764	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:03.511200905 CEST	49764	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:03.512850046 CEST	49764	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:03.512866974 CEST	443	49764	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:03.525979996 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.526333094 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.526350975 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.526628017 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.526916027 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.526971102 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.551753044 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.551943064 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.551965952 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.552285910 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.552575111 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.552634954 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.568703890 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.599939108 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.790548086 CEST	443	49762	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.790946960 CEST	49762	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.790965080 CEST	443	49762	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.791049004 CEST	443	49761	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.791209936 CEST	49761	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.791218996 CEST	443	49761	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.791500092 CEST	443	49761	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.791824102 CEST	443	49762	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.791919947 CEST	49762	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.791964054 CEST	49761	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.792032003 CEST	443	49761	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.792408943 CEST	49762	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.792464972 CEST	443	49762	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.801928997 CEST	443	49760	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.802634954 CEST	49760	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.802648067 CEST	443	49760	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.802920103 CEST	443	49760	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.803236008 CEST	49760	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.803294897 CEST	443	49760	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.833431005 CEST	49762	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.833445072 CEST	443	49762	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:03.833472967 CEST	49761	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.849060059 CEST	49760	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:03.881277084 CEST	49762	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:04.154906034 CEST	443	49764	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:04.154975891 CEST	49764	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:04.253354073 CEST	49764	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:04.253375053 CEST	443	49764	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:04.253568888 CEST	443	49764	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:04.297158003 CEST	49764	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:04.341694117 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.341716051 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.341871977 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.341871977 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.341880083 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.341941118 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.342175007 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.342185974 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.342330933 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.342339039 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.378515959 CEST	49764	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:04.420500040 CEST	443	49764	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:04.575083971 CEST	443	49764	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:04.575308084 CEST	49764	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:04.575331926 CEST	443	49764	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:04.575340033 CEST	49764	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:04.575422049 CEST	443	49764	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:04.575444937 CEST	443	49764	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:04.575488091 CEST	49764	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:04.605346918 CEST	49767	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:04.605376005 CEST	443	49767	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:04.605434895 CEST	49767	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:04.605695009 CEST	49767	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:04.605707884 CEST	443	49767	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:04.731847048 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:04.731867075 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:04.731940985 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:04.732156038 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:04.732167006 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:04.815509081 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.815931082 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.815943003 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.816287041 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.816342115 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.816916943 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.816970110 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.832739115 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.849282026 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.849288940 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.849596024 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.849658966 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.849798918 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.849857092 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.850198984 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.850250959 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.850627899 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.850677967 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.851263046 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.851273060 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.851713896 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.851718903 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.896917105 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.897104025 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.959194899 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.959475994 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.959515095 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.962691069 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.962701082 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.963711023 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.963984013 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:04.964045048 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.965239048 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:04.965243101 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.216648102 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.237843037 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:05.237857103 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.238881111 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.238949060 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:05.242327929 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:05.242382050 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.243191004 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:05.243196011 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.245023012 CEST	443	49767	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:05.245090008 CEST	49767	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:05.246875048 CEST	49767	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:05.246886969 CEST	443	49767	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:05.247098923 CEST	443	49767	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:05.248425961 CEST	49767	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:05.276202917 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.276223898 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.276345968 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.276684999 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.276690960 CEST	443	49770	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.276788950 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.277064085 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.277075052 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.277302027 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.277308941 CEST	443	49770	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.288508892 CEST	443	49767	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:05.289225101 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:05.340728045 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.340811014 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.340838909 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.340852022 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:05.340861082 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.340887070 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.340914011 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:05.340919018 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.340981007 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:05.341260910 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.341293097 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.341376066 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:05.343369007 CEST	49768	443	192.168.2.4	142.250.80.4
Aug 31, 2024 14:27:05.343375921 CEST	443	49768	142.250.80.4	192.168.2.4
Aug 31, 2024 14:27:05.521111965 CEST	443	49767	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:05.521157026 CEST	443	49767	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:05.521209002 CEST	49767	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:05.525697947 CEST	49767	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:05.525715113 CEST	443	49767	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:05.525724888 CEST	49767	443	192.168.2.4	184.28.90.27
Aug 31, 2024 14:27:05.525731087 CEST	443	49767	184.28.90.27	192.168.2.4
Aug 31, 2024 14:27:05.739171982 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.739391088 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.739401102 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.739701033 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.739768982 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.740287066 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.740334034 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.740736008 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.740786076 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.745717049 CEST	443	49770	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.745919943 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.745924950 CEST	443	49770	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.746225119 CEST	443	49770	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.746283054 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.746828079 CEST	443	49770	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.746882915 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.747046947 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.747097015 CEST	443	49770	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.787977934 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.787977934 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.787992001 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.788002014 CEST	443	49770	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.833395004 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.833587885 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:12.875996113 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:12.876041889 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:12.877199888 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:12.877199888 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:12.877238035 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:13.557885885 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:13.557955980 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:13.560681105 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:13.560692072 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:13.560894012 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:13.614727974 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:14.384402990 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:14.424499989 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.606056929 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.606076956 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.606084108 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.606111050 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.606125116 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.606132984 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.606148958 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:14.606173992 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.606189013 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:14.606219053 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:14.606885910 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.606950998 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:14.606960058 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.607033968 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:14.610656977 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:15.113209009 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:15.113245010 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:15.113260984 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:15.113267899 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:17.141050100 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:17.141088963 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:17.142708063 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:17.143179893 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:17.143193960 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:17.891829967 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:17.892134905 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:17.892153025 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:17.892492056 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:17.892503977 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:17.892546892 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:17.892554998 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:17.892688036 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:17.893086910 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:17.894336939 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:17.894393921 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:17.894507885 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:17.936501026 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:17.989908934 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:17.989924908 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.095561981 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.095601082 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.095805883 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.095997095 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.096010923 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.097160101 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.162975073 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.163014889 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.163240910 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.163250923 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.165638924 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.165684938 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.165693045 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.172084093 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.172199011 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.172205925 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.180309057 CEST	443	49756	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:18.180355072 CEST	443	49756	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:18.180421114 CEST	49756	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:18.180449009 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.180499077 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.180504084 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.184731007 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.184776068 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.184782982 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.190963030 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.191006899 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.191014051 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.197925091 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.197968006 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.197973967 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.203692913 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.204750061 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.204756975 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.382124901 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.449531078 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449594021 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449624062 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449661016 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449666023 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.449685097 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449713945 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449727058 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.449733973 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449748993 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.449770927 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449805021 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449819088 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.449826002 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449846983 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.449891090 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.449898005 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.450079918 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.450093031 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.450114965 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.450146914 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.450162888 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.450467110 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.450503111 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.450509071 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.450520039 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.450547934 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.450581074 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.450606108 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.450613976 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:18.450645924 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.450670958 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:18.450736046 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:18.454359055 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.454535961 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.454571962 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.454583883 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.454591990 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.454627037 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.454632044 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.455390930 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.455416918 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.455437899 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.455446005 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.455483913 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.456188917 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.456243038 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.456432104 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.456439018 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.456825018 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.456851959 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.456871986 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.456878901 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.457004070 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.457009077 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.457489967 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:18.457551956 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:18.457597971 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:18.457760096 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.457793951 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.457808018 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.457813978 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.457854986 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.458576918 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.458667040 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.458694935 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.458738089 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.458745956 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.458823919 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.459359884 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.459400892 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.459489107 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.459496021 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.460246086 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.460342884 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.460349083 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.460721970 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.460757971 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.460767031 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.461488008 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.461544991 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.461551905 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.461560011 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.461604118 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.461863041 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.462265968 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.462295055 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.462310076 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.462316036 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.462476015 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.462728024 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.463114977 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.463157892 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.463165045 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.463604927 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.463654995 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.463660955 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.464060068 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.464107037 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.464112997 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.464426994 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.464648008 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.464653969 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.465234995 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.465282917 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.465290070 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.465676069 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.465703011 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.465725899 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.465728998 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.465738058 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.465861082 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.466315985 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.466353893 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.466360092 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.466588974 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.466617107 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.466644049 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.466658115 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.466666937 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.466684103 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.466856956 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.466886044 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.466907024 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.466913939 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.466999054 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.467005014 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.467219114 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.467259884 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.467261076 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.467271090 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.467303991 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.467309952 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.467319965 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.467361927 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.467696905 CEST	49780	443	192.168.2.4	142.250.186.129
Aug 31, 2024 14:27:18.467701912 CEST	443	49780	142.250.186.129	192.168.2.4
Aug 31, 2024 14:27:18.737617016 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.737998962 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.738013029 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.739437103 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.739492893 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.743309021 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.743386984 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.743613958 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.743618965 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.829843044 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.840553045 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.840574980 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.840584040 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.840615988 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.840620041 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.840631962 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.840651035 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.840661049 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.840667963 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.840668917 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.840676069 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:18.840686083 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.840713978 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.842339039 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 31, 2024 14:27:18.842348099 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 31, 2024 14:27:19.326229095 CEST	59264	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:19.331163883 CEST	53	59264	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:19.331224918 CEST	59264	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:19.336540937 CEST	53	59264	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:19.776931047 CEST	59264	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:19.782501936 CEST	53	59264	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:19.782586098 CEST	59264	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:20.795454979 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:20.795480013 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:20.795599937 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:20.795857906 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:20.795867920 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:20.796195984 CEST	59267	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:20.796214104 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:20.796489000 CEST	59267	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:20.796489000 CEST	59267	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:20.796509981 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:20.883089066 CEST	59268	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:20.883096933 CEST	443	59268	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:20.883152962 CEST	59268	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:20.883737087 CEST	59268	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:20.883747101 CEST	443	59268	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:21.251241922 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.267393112 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.320687056 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.342947960 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.342957020 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.343319893 CEST	59267	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.343332052 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.343827963 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.343839884 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.343913078 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.344232082 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.344243050 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.344337940 CEST	59267	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.359388113 CEST	443	59268	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:21.373245001 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.373302937 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.374425888 CEST	59268	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:21.374434948 CEST	443	59268	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:21.375427961 CEST	443	59268	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:21.375519037 CEST	59268	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:21.376126051 CEST	59267	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.376183987 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.377388954 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.377399921 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.378057003 CEST	59268	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:21.378129005 CEST	443	59268	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:21.378650904 CEST	59267	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.378662109 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.379082918 CEST	59268	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:21.379090071 CEST	443	59268	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:21.417007923 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.429868937 CEST	59268	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:21.430118084 CEST	59267	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.478852034 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.478905916 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.479032993 CEST	59267	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.479182959 CEST	59267	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.479193926 CEST	443	59267	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.480992079 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.481035948 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.481131077 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.481163025 CEST	59266	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:21.481170893 CEST	443	59266	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:21.482475996 CEST	443	59268	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:21.482538939 CEST	443	59268	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:21.482654095 CEST	59268	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:21.482738018 CEST	59268	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:21.482743025 CEST	443	59268	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:35.414026022 CEST	59269	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.414058924 CEST	443	59269	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.414150953 CEST	59269	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.414175034 CEST	59270	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.414180040 CEST	443	59270	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.414231062 CEST	59270	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.414407015 CEST	59269	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.414417982 CEST	443	59269	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.414510012 CEST	59270	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.414518118 CEST	443	59270	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.866661072 CEST	443	59270	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.866966963 CEST	59270	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.866976976 CEST	443	59270	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.867259979 CEST	443	59270	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.867733002 CEST	59270	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.867790937 CEST	443	59270	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.868109941 CEST	59270	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.897834063 CEST	443	59269	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.898045063 CEST	59269	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.898051977 CEST	443	59269	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.898382902 CEST	443	59269	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.899000883 CEST	59269	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.899060965 CEST	443	59269	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.912501097 CEST	443	59270	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.943665981 CEST	59269	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.994450092 CEST	443	59270	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.994496107 CEST	443	59270	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.994712114 CEST	59270	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.994797945 CEST	59270	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.994808912 CEST	443	59270	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.995224953 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:35.995238066 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:35.995384932 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:35.995595932 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:35.995604992 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.768150091 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.768407106 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:36.768423080 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.769519091 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.769579887 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:36.770519972 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:36.770570993 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.770878077 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:36.770888090 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.819633007 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:36.868007898 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.869287968 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.869296074 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.869338036 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.869343042 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:36.869357109 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.869365931 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:36.869379044 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:36.869407892 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:36.870373011 CEST	59271	443	192.168.2.4	152.195.19.97
Aug 31, 2024 14:27:36.870382071 CEST	443	59271	152.195.19.97	192.168.2.4
Aug 31, 2024 14:27:37.148236036 CEST	59272	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.148262024 CEST	443	59272	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.148508072 CEST	59272	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.148761988 CEST	59273	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.148778915 CEST	443	59273	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.148829937 CEST	59273	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.148943901 CEST	59272	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.148955107 CEST	443	59272	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.149240971 CEST	59273	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.149250984 CEST	443	59273	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.600061893 CEST	443	59273	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.600677967 CEST	59273	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.600689888 CEST	443	59273	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.601022959 CEST	443	59273	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.602058887 CEST	59273	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.602124929 CEST	443	59273	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.602480888 CEST	59273	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.609755993 CEST	443	59272	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.612329006 CEST	59272	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.612341881 CEST	443	59272	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.612624884 CEST	443	59272	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.617990017 CEST	59272	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.618045092 CEST	443	59272	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.644500971 CEST	443	59273	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.661273956 CEST	59272	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.727509975 CEST	443	59273	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.727572918 CEST	443	59273	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.728394985 CEST	59273	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.728578091 CEST	59273	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.728585958 CEST	443	59273	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:48.803240061 CEST	49760	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:48.803241968 CEST	49761	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:48.803252935 CEST	443	49760	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:48.803262949 CEST	443	49761	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:48.834492922 CEST	49762	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:27:48.834501028 CEST	443	49762	142.250.64.67	192.168.2.4
Aug 31, 2024 14:27:50.800858974 CEST	443	59269	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:50.800926924 CEST	443	59269	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:50.801033974 CEST	59269	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:50.802150965 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:50.802165031 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:50.802194118 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:50.802200079 CEST	443	49770	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:52.518356085 CEST	443	59272	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:52.518414974 CEST	443	59272	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:52.518527985 CEST	59272	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:55.951230049 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:55.951273918 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:55.951365948 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:55.951682091 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:55.951697111 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.654834032 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.654918909 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.658821106 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.658833027 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.659049034 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.667548895 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.712500095 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.814414024 CEST	59277	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:56.814448118 CEST	443	59277	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:56.814522028 CEST	59277	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:56.814757109 CEST	59278	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:56.814764023 CEST	443	59278	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:56.814817905 CEST	59278	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:56.814960003 CEST	59277	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:56.814970970 CEST	443	59277	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:56.815120935 CEST	59278	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:56.815130949 CEST	443	59278	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:56.923743963 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.923763990 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.923779011 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.923818111 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.923830986 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.923856020 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.923878908 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.924731016 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.924772978 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.924787998 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.924793959 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.924823046 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.925084114 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.925113916 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.925122023 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.925154924 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.930391073 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.930413008 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:56.930428028 CEST	59276	443	192.168.2.4	13.85.23.86
Aug 31, 2024 14:27:56.930433989 CEST	443	59276	13.85.23.86	192.168.2.4
Aug 31, 2024 14:27:57.270121098 CEST	443	59277	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.270307064 CEST	443	59278	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.270349979 CEST	59277	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.270359993 CEST	443	59277	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.270467043 CEST	59278	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.270473957 CEST	443	59278	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.270647049 CEST	443	59277	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.270816088 CEST	443	59278	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.270915985 CEST	59277	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.270970106 CEST	443	59277	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.271146059 CEST	59278	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.271209002 CEST	443	59278	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.318264961 CEST	59277	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.318264961 CEST	59278	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:59.054528952 CEST	49756	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.054559946 CEST	443	49756	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.781435013 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:27:59.781466007 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:27:59.784914970 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:27:59.785100937 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:27:59.785109997 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:28:00.270175934 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:28:00.270585060 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:28:00.270595074 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:28:00.272037029 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:28:00.272104025 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:28:00.272413969 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:28:00.272511959 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:28:00.272546053 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:28:00.316498041 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:28:00.317454100 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:28:00.317466974 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:28:00.368568897 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:28:00.412089109 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:28:00.412153006 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:28:00.412206888 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:28:00.412528038 CEST	59280	443	192.168.2.4	23.54.161.105
Aug 31, 2024 14:28:00.412538052 CEST	443	59280	23.54.161.105	192.168.2.4
Aug 31, 2024 14:28:03.458554029 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:03.458556890 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:03.458590031 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:03.458590031 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:07.271516085 CEST	49723	80	192.168.2.4	93.184.221.240
Aug 31, 2024 14:28:07.271567106 CEST	49724	80	192.168.2.4	93.184.221.240
Aug 31, 2024 14:28:07.276566982 CEST	80	49723	93.184.221.240	192.168.2.4
Aug 31, 2024 14:28:07.276622057 CEST	49723	80	192.168.2.4	93.184.221.240
Aug 31, 2024 14:28:07.277009964 CEST	80	49724	93.184.221.240	192.168.2.4
Aug 31, 2024 14:28:07.277055979 CEST	49724	80	192.168.2.4	93.184.221.240
Aug 31, 2024 14:28:12.179598093 CEST	443	59278	162.159.61.3	192.168.2.4
Aug 31, 2024 14:28:12.179666996 CEST	443	59278	162.159.61.3	192.168.2.4
Aug 31, 2024 14:28:12.179835081 CEST	59278	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:28:12.180419922 CEST	443	59277	162.159.61.3	192.168.2.4
Aug 31, 2024 14:28:12.180489063 CEST	443	59277	162.159.61.3	192.168.2.4
Aug 31, 2024 14:28:12.180536985 CEST	59277	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:28:15.400373936 CEST	59272	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:28:15.400393963 CEST	443	59272	162.159.61.3	192.168.2.4
Aug 31, 2024 14:28:33.817821026 CEST	49760	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:28:33.817826033 CEST	49761	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:28:33.817837000 CEST	443	49760	142.250.64.67	192.168.2.4
Aug 31, 2024 14:28:33.817847013 CEST	443	49761	142.250.64.67	192.168.2.4
Aug 31, 2024 14:28:33.851932049 CEST	49762	443	192.168.2.4	142.250.64.67
Aug 31, 2024 14:28:33.851947069 CEST	443	49762	142.250.64.67	192.168.2.4
Aug 31, 2024 14:28:35.802934885 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:28:35.802934885 CEST	49770	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:28:35.802938938 CEST	59269	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:28:35.802958012 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 14:28:35.802959919 CEST	443	59269	162.159.61.3	192.168.2.4
Aug 31, 2024 14:28:35.802984953 CEST	443	49770	142.250.65.238	192.168.2.4
Aug 31, 2024 14:28:48.459487915 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:48.459513903 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:48.461134911 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:48.461172104 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:57.180346012 CEST	59278	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:28:57.180367947 CEST	443	59278	162.159.61.3	192.168.2.4
Aug 31, 2024 14:28:57.180401087 CEST	59277	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:28:57.180407047 CEST	443	59277	162.159.61.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 14:26:58.362740040 CEST	53	64342	1.1.1.1	192.168.2.4
Aug 31, 2024 14:26:59.047983885 CEST	54987	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:26:59.048141956 CEST	49552	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:00.782185078 CEST	53	54381	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:00.793273926 CEST	53	61197	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:01.843338966 CEST	63478	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:01.843338966 CEST	65218	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:01.843867064 CEST	61664	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:01.844048977 CEST	51218	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:01.844469070 CEST	52532	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:01.844621897 CEST	54464	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:01.845226049 CEST	55124	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:01.845499992 CEST	61247	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:01.851444006 CEST	53	65218	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:01.851617098 CEST	53	54464	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:01.851721048 CEST	53	61664	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:01.852288008 CEST	53	52532	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:01.852297068 CEST	53	63478	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:01.852304935 CEST	53	51218	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:01.852895021 CEST	53	61247	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:01.853919983 CEST	53	55124	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:01.956146955 CEST	59170	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:01.956146955 CEST	58510	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:01.963363886 CEST	53	59170	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:01.963373899 CEST	53	58510	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:02.759114981 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:02.799452066 CEST	54530	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.068825006 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.099545956 CEST	54530	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.233129025 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.233140945 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.233150959 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.233160973 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.233176947 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.233540058 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.235224009 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.235333920 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.235537052 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.235677004 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.268395901 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.268578053 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.268589973 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.268640041 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.268649101 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.268773079 CEST	54530	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.270199060 CEST	54530	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.270339012 CEST	54530	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.270690918 CEST	54530	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.331084013 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.331289053 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.331298113 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.331402063 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.331464052 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.331578970 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.331737995 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.332318068 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.332472086 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.366117001 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.366218090 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.366228104 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.366236925 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.366373062 CEST	54530	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.366451025 CEST	54530	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.366847992 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.367572069 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.394270897 CEST	54530	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.425656080 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.452526093 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.462331057 CEST	443	54530	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:03.487548113 CEST	54530	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.928021908 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:03.928257942 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:04.023689032 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:04.024564981 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:04.024871111 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:04.025346994 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:04.244843960 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:04.245023012 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:04.340193987 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:04.340691090 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:04.340892076 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:04.341002941 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:04.635183096 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:04.635293961 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:04.730005026 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:04.730963945 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:04.731102943 CEST	443	64534	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:04.731430054 CEST	64534	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:04.964488029 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.275898933 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.425642014 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.425733089 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.426161051 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.433850050 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.433861017 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.433871984 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.434114933 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.435451984 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.436566114 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.437381029 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.437506914 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.438075066 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.438100100 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.444593906 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.533658028 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.533710957 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.534157991 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.534488916 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.540729046 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.542718887 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.551455975 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.551875114 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.553049088 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.554764032 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.554773092 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:05.555824041 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.585522890 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:05.649764061 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:13.728508949 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:13.728550911 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:13.823144913 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:13.863375902 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:13.863446951 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:13.863759995 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:13.892616034 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:13.982836962 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:17.131668091 CEST	51979	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:17.131829023 CEST	53111	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:17.139452934 CEST	53	51979	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:17.139463902 CEST	53	53111	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:18.857482910 CEST	138	138	192.168.2.4	192.168.2.255
Aug 31, 2024 14:27:19.325624943 CEST	53	49745	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:19.605376005 CEST	53	60774	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:20.787388086 CEST	58524	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:20.787556887 CEST	49437	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:20.787755966 CEST	59586	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:20.787956953 CEST	55797	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:20.794132948 CEST	53	58524	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:20.794713020 CEST	53	49437	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:20.794970989 CEST	53	59586	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:20.795425892 CEST	53	55797	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:20.875355959 CEST	61374	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:20.875355959 CEST	63355	53	192.168.2.4	1.1.1.1
Aug 31, 2024 14:27:20.882498026 CEST	53	63355	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:20.882508039 CEST	53	61374	1.1.1.1	192.168.2.4
Aug 31, 2024 14:27:34.445583105 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:34.445739985 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:34.540412903 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:34.554471016 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:34.554482937 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:34.554758072 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:34.583338976 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:34.674784899 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:35.398535967 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:35.398643970 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:35.413705111 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.495888948 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:35.507847071 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:35.508198023 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:35.627652884 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:35.648350000 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:35.648401022 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:35.725936890 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.743753910 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:35.758085012 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:35.758095026 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:35.758326054 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:35.787977934 CEST	62488	443	192.168.2.4	142.250.65.238
Aug 31, 2024 14:27:35.877793074 CEST	443	62488	142.250.65.238	192.168.2.4
Aug 31, 2024 14:27:35.888077974 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.888089895 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.888099909 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.888109922 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.888122082 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.888782024 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.890675068 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.890928984 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.891367912 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.992465019 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.992532969 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.992541075 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.992547989 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:35.992858887 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.993058920 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:35.993758917 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:36.022077084 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:36.092032909 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:36.130923986 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.145845890 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.146445990 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.147516012 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.249157906 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.249560118 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.249687910 CEST	443	50191	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.250324011 CEST	50191	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.458228111 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.608176947 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.608191013 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.608835936 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.608845949 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.608856916 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.609431028 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.611021042 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.611738920 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.611996889 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.613086939 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.707055092 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.708067894 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.708077908 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.708085060 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.708306074 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.708499908 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.709486008 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.710455894 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.740704060 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:37.802947998 CEST	443	52981	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:37.834043026 CEST	52981	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:56.814176083 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.116445065 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.259656906 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.259954929 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.259964943 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.259975910 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.259984970 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.260221958 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.261970043 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.262079954 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.262290955 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.262577057 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.358272076 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.358280897 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.358289957 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.358297110 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.358730078 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.358813047 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.358815908 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.358978987 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.359224081 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:57.454035044 CEST	443	61349	162.159.61.3	192.168.2.4
Aug 31, 2024 14:27:57.490236998 CEST	61349	443	192.168.2.4	162.159.61.3
Aug 31, 2024 14:27:59.055386066 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.055565119 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.055743933 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.055856943 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.491341114 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.523349047 CEST	443	57428	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.523910046 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.553725004 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.584805965 CEST	443	57428	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.584826946 CEST	443	57428	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.584903955 CEST	443	57428	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.584913015 CEST	443	57428	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.585140944 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.585227013 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.585309029 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.618740082 CEST	443	57428	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.647439957 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.678843021 CEST	443	57428	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.680998087 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:27:59.775948048 CEST	443	57428	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.776717901 CEST	443	57428	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.777354956 CEST	443	57428	172.64.41.3	192.168.2.4
Aug 31, 2024 14:27:59.780949116 CEST	57428	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:05.793059111 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:05.793111086 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:05.793343067 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:05.793448925 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:06.193133116 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:06.325099945 CEST	443	60182	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:06.325114965 CEST	443	60182	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:06.325133085 CEST	443	60182	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:06.325141907 CEST	443	60182	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:06.325150967 CEST	443	60182	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:06.325690031 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:06.325793028 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:06.325860023 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:06.325905085 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:06.421102047 CEST	443	60182	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:06.421372890 CEST	443	60182	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:06.421685934 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:06.519002914 CEST	443	60182	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:06.519581079 CEST	443	60182	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:06.519588947 CEST	443	60182	172.64.41.3	192.168.2.4
Aug 31, 2024 14:28:06.520246983 CEST	60182	443	192.168.2.4	172.64.41.3
Aug 31, 2024 14:28:06.521048069 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:06.521178961 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:06.865376949 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:06.977649927 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:06.984064102 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:06.984075069 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:06.984519005 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:06.984736919 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:06.984764099 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:06.984884977 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:06.984894991 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:07.003262997 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:07.084084988 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:07.084676027 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:07.084940910 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:07.084961891 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:07.085352898 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:07.085361958 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:07.098980904 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:07.099180937 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:07.099216938 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:07.099638939 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:07.099786043 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:07.099802017 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:07.130870104 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:07.199255943 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:35.840392113 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:35.940428019 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:35.941083908 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:35.941083908 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:35.965358973 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:35.966336966 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:36.048975945 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:36.055102110 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:36.055267096 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:36.055468082 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:36.085752964 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:36.180104017 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:38.789829969 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:38.789880037 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:38.891043901 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:38.906858921 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:38.907023907 CEST	443	55522	142.250.65.174	192.168.2.4
Aug 31, 2024 14:28:38.907233000 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:38.943777084 CEST	55522	443	192.168.2.4	142.250.65.174
Aug 31, 2024 14:28:39.035197020 CEST	443	55522	142.250.65.174	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 14:26:59.047983885 CEST	192.168.2.4	1.1.1.1	0x864d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:26:59.048141956 CEST	192.168.2.4	1.1.1.1	0x8c87	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 31, 2024 14:27:01.843338966 CEST	192.168.2.4	1.1.1.1	0xda75	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.843338966 CEST	192.168.2.4	1.1.1.1	0x2b32	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 14:27:01.843867064 CEST	192.168.2.4	1.1.1.1	0x944f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.844048977 CEST	192.168.2.4	1.1.1.1	0xaab1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 14:27:01.844469070 CEST	192.168.2.4	1.1.1.1	0x73ba	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.844621897 CEST	192.168.2.4	1.1.1.1	0x84d5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 14:27:01.845226049 CEST	192.168.2.4	1.1.1.1	0xffcd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.845499992 CEST	192.168.2.4	1.1.1.1	0x8cce	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 14:27:01.956146955 CEST	192.168.2.4	1.1.1.1	0xdf59	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 14:27:01.956146955 CEST	192.168.2.4	1.1.1.1	0xb506	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:17.131668091 CEST	192.168.2.4	1.1.1.1	0xd633	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:17.131829023 CEST	192.168.2.4	1.1.1.1	0x4980	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Aug 31, 2024 14:27:20.787388086 CEST	192.168.2.4	1.1.1.1	0xd82d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:20.787556887 CEST	192.168.2.4	1.1.1.1	0xc8f3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 14:27:20.787755966 CEST	192.168.2.4	1.1.1.1	0x3049	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:20.787956953 CEST	192.168.2.4	1.1.1.1	0x9234	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 14:27:20.875355959 CEST	192.168.2.4	1.1.1.1	0x2d74	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 14:27:20.875355959 CEST	192.168.2.4	1.1.1.1	0x32e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 14:26:59.054831982 CEST	1.1.1.1	192.168.2.4	0x864d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:26:59.054955006 CEST	1.1.1.1	192.168.2.4	0x8c87	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:01.851444006 CEST	1.1.1.1	192.168.2.4	0x2b32	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 14:27:01.851617098 CEST	1.1.1.1	192.168.2.4	0x84d5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 14:27:01.851721048 CEST	1.1.1.1	192.168.2.4	0x944f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.851721048 CEST	1.1.1.1	192.168.2.4	0x944f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.852288008 CEST	1.1.1.1	192.168.2.4	0x73ba	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.852288008 CEST	1.1.1.1	192.168.2.4	0x73ba	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.852297068 CEST	1.1.1.1	192.168.2.4	0xda75	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.852297068 CEST	1.1.1.1	192.168.2.4	0xda75	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.852304935 CEST	1.1.1.1	192.168.2.4	0xaab1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 14:27:01.852895021 CEST	1.1.1.1	192.168.2.4	0x8cce	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 14:27:01.853919983 CEST	1.1.1.1	192.168.2.4	0xffcd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.853919983 CEST	1.1.1.1	192.168.2.4	0xffcd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.963363886 CEST	1.1.1.1	192.168.2.4	0xdf59	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 14:27:01.963373899 CEST	1.1.1.1	192.168.2.4	0xb506	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:01.963373899 CEST	1.1.1.1	192.168.2.4	0xb506	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:02.196904898 CEST	1.1.1.1	192.168.2.4	0xcbd5	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:02.196904898 CEST	1.1.1.1	192.168.2.4	0xcbd5	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:17.139452934 CEST	1.1.1.1	192.168.2.4	0xd633	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:17.139452934 CEST	1.1.1.1	192.168.2.4	0xd633	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:17.139463902 CEST	1.1.1.1	192.168.2.4	0x4980	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:18.094799042 CEST	1.1.1.1	192.168.2.4	0x600d	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:18.094799042 CEST	1.1.1.1	192.168.2.4	0x600d	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:18.491825104 CEST	1.1.1.1	192.168.2.4	0xa9cd	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:18.492119074 CEST	1.1.1.1	192.168.2.4	0xba38	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:18.492119074 CEST	1.1.1.1	192.168.2.4	0xba38	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:19.513376951 CEST	1.1.1.1	192.168.2.4	0xe1bc	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:19.513376951 CEST	1.1.1.1	192.168.2.4	0xe1bc	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:19.514813900 CEST	1.1.1.1	192.168.2.4	0x7682	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:20.794132948 CEST	1.1.1.1	192.168.2.4	0xd82d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:20.794132948 CEST	1.1.1.1	192.168.2.4	0xd82d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:20.794713020 CEST	1.1.1.1	192.168.2.4	0xc8f3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 14:27:20.794970989 CEST	1.1.1.1	192.168.2.4	0x3049	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:20.794970989 CEST	1.1.1.1	192.168.2.4	0x3049	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:20.795425892 CEST	1.1.1.1	192.168.2.4	0x9234	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 14:27:20.882498026 CEST	1.1.1.1	192.168.2.4	0x32e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:20.882498026 CEST	1.1.1.1	192.168.2.4	0x32e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:20.882508039 CEST	1.1.1.1	192.168.2.4	0x2d74	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 14:27:21.546358109 CEST	1.1.1.1	192.168.2.4	0x3835	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:21.546358109 CEST	1.1.1.1	192.168.2.4	0x3835	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:22.790599108 CEST	1.1.1.1	192.168.2.4	0x3835	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:22.790599108 CEST	1.1.1.1	192.168.2.4	0x3835	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:23.562684059 CEST	1.1.1.1	192.168.2.4	0x3835	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:23.562684059 CEST	1.1.1.1	192.168.2.4	0x3835	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:25.575437069 CEST	1.1.1.1	192.168.2.4	0x3835	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:25.575437069 CEST	1.1.1.1	192.168.2.4	0x3835	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 14:27:29.577867031 CEST	1.1.1.1	192.168.2.4	0x3835	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 14:27:29.577867031 CEST	1.1.1.1	192.168.2.4	0x3835	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
2024-08-31 12:27:35 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	true

HTTP Request Dependency Graph

chrome.cloudflare-dns.com

edgeassetservice.azureedge.net

https:

www.google.com

fs.microsoft.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49749	162.159.61.3	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 12:27:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd032c1b5f42cc-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 61 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomaPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49748	172.64.41.3	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 12:27:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd032c1dcd8cc6-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49750	172.64.41.3	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 12:27:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd032c1da30fa1-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 de 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49747	172.64.41.3	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 12:27:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd032c19005e72-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1e 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49751	172.64.41.3	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 12:27:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd032cc82d1879-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 4b 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomKPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49752	13.107.246.60	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:02 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 12:27:02 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 12:27:02 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T122702Z-16579567576gnfmq2acf56mm7000000004v0000000002fwx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-31 12:27:02 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-31 12:27:03 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-31 12:27:03 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-31 12:27:03 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-31 12:27:03 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	13.107.246.60	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:02 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 12:27:02 UTC	559	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 12:27:02 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T122702Z-16579567576mj4tc2xukwvxfxc00000004n00000000091zm Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-31 12:27:02 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49755	172.64.41.3	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 12:27:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd0331999dc427-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e4 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49757	172.64.41.3	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 61 72 63 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 58 00 0c 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: arcmsncom)XT
2024-08-31 12:27:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd0331edd8c47a-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 03 61 72 63 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 54 4a 00 18 03 61 72 63 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 29 00 05 00 01 00 00 00 26 00 35 1b 69 72 69 73 2d 64 65 2d 70 72 6f 64 2d 61 7a 73 63 2d 76 32 2d 65 75 73 32 2d 62 07 65 61 73 74 75 73 32 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 14 c0 4d 00 01 00 01 00 00 00 03 00 04 14 4b 3c 5b 00 00 29 04 d0 00 00 00 00 01 37 00 0c 01 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: arcmsncomTJarctrafficmanagernet)&5iris-de-prod-azsc-v2-eus2-beastus2cloudappazureMK<[)73

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49764	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:04 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 12:27:04 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=15529 Date: Sat, 31 Aug 2024 12:27:04 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49766	142.250.65.238	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:04 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 12:27:04 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 12:27:04 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49765	142.250.65.238	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:04 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 12:27:04 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 12:27:04 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49768	142.250.80.4	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:05 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 12:27:05 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 31 Aug 2024 10:53:11 GMT Expires: Sun, 08 Sep 2024 10:53:11 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 5634 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-31 12:27:05 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-31 12:27:05 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-31 12:27:05 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-31 12:27:05 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-31 12:27:05 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49767	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:05 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 12:27:05 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=25966 Date: Sat, 31 Aug 2024 12:27:05 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-31 12:27:05 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49771	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BHmAtvAMZOE42Fb&MD=nk2NsEKm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 12:27:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e4213140-d36b-4928-bfda-b03241a0f98f MS-RequestId: a89131ac-e435-484c-9d61-8c70ad272294 MS-CV: 2oS3yrsn0kSU7UCX.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 12:27:13 GMT Connection: close Content-Length: 24490
2024-08-31 12:27:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-31 12:27:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49780	142.250.186.129	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:17 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 12:27:18 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljsvkdyLQN5ME9bCDQAD9zre8w85c1BzOiR-oI3BSc8K7KfSTlxuG8dj8ALvmiOTcFyKqvH62Hs3pQ X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Fri, 30 Aug 2024 19:15:10 GMT Expires: Sat, 30 Aug 2025 19:15:10 GMT Cache-Control: public, max-age=31536000 Age: 61928 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-31 12:27:18 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-08-31 12:27:18 UTC	1390	IN	Data Raw: fd c7 0f 59 dd ca cf cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d Data Ascii: Y0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>
2024-08-31 12:27:18 UTC	1390	IN	Data Raw: b0 78 c3 9a 50 64 5d fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad Data Ascii: xPd]DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewW
2024-08-31 12:27:18 UTC	1390	IN	Data Raw: d9 73 4a e4 91 70 9d a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d Data Ascii: sJp:fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~
2024-08-31 12:27:18 UTC	1390	IN	Data Raw: 58 f0 77 67 86 f4 73 f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb Data Ascii: Xwgs9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:
2024-08-31 12:27:18 UTC	1390	IN	Data Raw: 4d 15 00 a4 81 86 68 ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a Data Ascii: Mh3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:
2024-08-31 12:27:18 UTC	1390	IN	Data Raw: a0 8e 2c ba 65 e8 66 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 Data Ascii: ,ef4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$
2024-08-31 12:27:18 UTC	1390	IN	Data Raw: 3f ec fa 62 d7 ae 70 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 Data Ascii: ?bpnh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u
2024-08-31 12:27:18 UTC	1390	IN	Data Raw: f9 d6 22 50 e1 7c 45 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 Data Ascii: "P\|E'3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9
2024-08-31 12:27:18 UTC	1390	IN	Data Raw: 4e 57 c1 ef e1 60 9a 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f Data Ascii: NW`^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gOD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49785	13.107.246.60	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:18 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 12:27:18 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 12:27:18 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T122718Z-16579567576h9nndaeer0cv35w00000004q000000000d15e Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-31 12:27:18 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	59266	162.159.61.3	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:21 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:21 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 12:27:21 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:21 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd03a2eefb0f75-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:21 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0d 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	59267	162.159.61.3	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:21 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:21 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 12:27:21 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:21 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd03a2eacc8cc3-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:21 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	59268	172.64.41.3	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:21 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:21 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 12:27:21 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:21 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd03a2fc5f19e7-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:21 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	59270	162.159.61.3	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA)/+
2024-08-31 12:27:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd03fdadb3437b-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 06 00 01 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0c ae 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 01 50 1e 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 01 0a 00 1c 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 09 61 7a 75 72 65 65 64 67 65 c0 b3 c0 c4 00 05 00 01 00 00 06 e6 00 15 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 02 65 63 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA4starsftludldeliverympmicrosoftcomdelivery3RP&cdp-f-ssl-tlu-nettrafficmanagernetwildcardtlu-sslazureedgewildcardtlu-sslec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	59271	152.195.19.97	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:36 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725712038&P2=404&P3=2&P4=j0Y8wo9%2b1wsfZw2uSta2qy3iKMYYIZwVKbmDurNRC%2f70S2VTf7sLxYzpIV4ybj5pFKDLp1R3R%2f0YEO8I%2bsYjjg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: Ejgl2VTz9fs7Cz4ddkR69K Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 12:27:36 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5033787 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sat, 31 Aug 2024 12:27:36 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-08-31 12:27:36 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	59273	162.159.61.3	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 12:27:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-08-31 12:27:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 12:27:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbd0408898f4277-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 12:27:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d e0 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 0c 00 02 c0 43 c0 43 00 01 00 01 00 00 00 0c 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 0c 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCOCk)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	59276	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:27:56 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BHmAtvAMZOE42Fb&MD=nk2NsEKm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 12:27:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: b25e5de4-197a-48c5-819b-bb6ebe7693b8 MS-RequestId: 84d70a83-812c-46c7-9d60-f0aa441f4841 MS-CV: gUgQ+KbpaUCteu2P.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 12:27:56 GMT Connection: close Content-Length: 30005
2024-08-31 12:27:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-31 12:27:56 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	59280	23.54.161.105	443	8028	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 12:28:00 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 12:28:00 UTC	378	IN	HTTP/1.1 503 Service Unavailable Content-Length: 326 Content-Type: text/html; charset=us-ascii Date: Sat, 31 Aug 2024 12:28:00 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.65a13617.1725107280.d415d85 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-08-31 12:28:00 UTC	326	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><

Target ID:	0
Start time:	08:26:54
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf60000
File size:	917'504 bytes
MD5 hash:	29517E92D7761860F63FC179B031172D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:26:54
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:26:55
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1912,i,14927301562858927036,17486074749245715657,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:26:55
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:26:55
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	08:27:00
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6964 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:27:00
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6924 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:27:01
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7264 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff636d90000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:27:01
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7264 --field-trial-handle=2100,i,7899137366586922466,2008247375892886544,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff636d90000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:27:14
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	08:27:14
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:27:15
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4380 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:27:16
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5936 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8
Imagebase:	0x7ff636d90000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:27:17
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5936 --field-trial-handle=2080,i,11617784482240175142,8473891388629235489,262144 /prefetch:8
Imagebase:	0x7ff636d90000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:27:22
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:27:22
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2136,i,8358726589988905898,12135449395727678176,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:27:30
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:27:30
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2012,i,16325592486181929510,8706679362806324628,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:27:43
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:27:44
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2000,i,18419734026850223722,7640752483822998294,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	1366
Total number of Limit Nodes:	34

Executed Functions

Function 00F642DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00F6430D

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

GetCurrentProcess.KERNEL32(?,00FFCB64,00000000,?,?), ref: 00F64422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00F64429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00F64454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00F64466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00F64474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00F6447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00F644A0

Strings

GetNativeSystemInfo, xrefs: 00F64460
|O, xrefs: 00FA36F8
kernel32.dll, xrefs: 00F6444F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: b761bf35ee98db07a4ec0675753b8f4041ea386d44e2e2e1db24e6a2d3be452c
Instruction ID: 332de3c6d5f1aa11d56fe545a309f65ad2954575eb0b7e85fb576585176e524b
Opcode Fuzzy Hash: b761bf35ee98db07a4ec0675753b8f4041ea386d44e2e2e1db24e6a2d3be452c
Instruction Fuzzy Hash: A2A1B672D0E2D4DFC731DB6974416E57FAC6F2E310B08D499E4C1A3B0AD63A5508EBA1

Function 00F642A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00F650AA,?,?,00000000,00000000), ref: 00F642B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00F650AA,?,?,00000000,00000000), ref: 00F642C9
LoadResource.KERNEL32(?,00000000,?,?,00F650AA,?,?,00000000,00000000,?,?,?,?,?,?,00F64F20), ref: 00FA35BE
SizeofResource.KERNEL32(?,00000000,?,?,00F650AA,?,?,00000000,00000000,?,?,?,?,?,?,00F64F20), ref: 00FA35D3
LockResource.KERNEL32(00F650AA,?,?,00F650AA,?,?,00000000,00000000,?,?,?,?,?,?,00F64F20,?), ref: 00FA35E6

Strings

SCRIPT, xrefs: 00F642BF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 665f685010c6ba919704c752c7c24a0931753a70644f62b56cfedbf361182684
Instruction ID: d4796acb0907c78e797db9d0cf00926c01123685157068c33c9cd46c013fb5cb
Opcode Fuzzy Hash: 665f685010c6ba919704c752c7c24a0931753a70644f62b56cfedbf361182684
Instruction Fuzzy Hash: A8119A70600208AFD7219B65DD58F277BBDEFC5B51F204269F402962A0DB71E810E670

Function 00FA2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00F62B6B

Part of subcall function 00F63A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,01031418,?,00F62E7F,?,?,?,00000000), ref: 00F63A78

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,01022224), ref: 00FA2C10
ShellExecuteW.SHELL32(00000000,?,?,01022224), ref: 00FA2C17

Strings

runas, xrefs: 00FA2C0B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: f21baa57c3b23d91b6c4a3d5ecce5485ea0258ebd89c7e83c7986c9f67be0417
Instruction ID: 61350b2ea493af58fee556266b8ff6430a1242cede44402b4f749afc6a38bc5d
Opcode Fuzzy Hash: f21baa57c3b23d91b6c4a3d5ecce5485ea0258ebd89c7e83c7986c9f67be0417
Instruction Fuzzy Hash: CA11D032608345AAC714FF64DD529BEB7A8EFDA350F44042DF182571A2CF398A49F762

Function 00FCDBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00FA5222), ref: 00FCDBCE
GetFileAttributesW.KERNELBASE(?), ref: 00FCDBDD
FindFirstFileW.KERNEL32(?,?), ref: 00FCDBEE
FindClose.KERNEL32(00000000), ref: 00FCDBFA

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: e6dce5380bb5cf9d433bc091b6e34d620e833baf286c2bb0d1ec4abff39346d3
Instruction ID: d3b1180a32705d4126020cf66322438ab0741027734d0e26edfb6419a12607f1
Opcode Fuzzy Hash: e6dce5380bb5cf9d433bc091b6e34d620e833baf286c2bb0d1ec4abff39346d3
Instruction Fuzzy Hash: 3BF0A031810929578220AB78AE0E9BE376C9E01334B10471AF836C21F0EBB06954E6D5

Function 00FEAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00FEB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FEB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FEB1D4
_wcslen.LIBCMT ref: 00FEB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FEB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FEB236
_wcslen.LIBCMT ref: 00FEB332

Part of subcall function 00FD05A7: GetStdHandle.KERNEL32(000000F6), ref: 00FD05C6

_wcslen.LIBCMT ref: 00FEB34B
_wcslen.LIBCMT ref: 00FEB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FEB3B6
GetLastError.KERNEL32(00000000), ref: 00FEB407
CloseHandle.KERNEL32(?), ref: 00FEB439
CloseHandle.KERNEL32(00000000), ref: 00FEB44A
CloseHandle.KERNEL32(00000000), ref: 00FEB45C
CloseHandle.KERNEL32(00000000), ref: 00FEB46E
CloseHandle.KERNEL32(?), ref: 00FEB4E3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: fee9ca0256dba23e4a2ea76a68320b6729f92171c29c3684de226c70435a5c1d
Instruction ID: 94f66aff7cf36a4366c766504221e011c4b6665ef33e150405422e148d31920d
Opcode Fuzzy Hash: fee9ca0256dba23e4a2ea76a68320b6729f92171c29c3684de226c70435a5c1d
Instruction Fuzzy Hash: 38F1C0319083409FC715EF25C891B6FBBE5AF85324F18845EF4998B2A2DB35EC44EB52

Function 00F6D730 Relevance: 21.6, APIs: 14, Instructions: 624windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00F6D807
timeGetTime.WINMM ref: 00F6DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F6DB28
TranslateMessage.USER32(?), ref: 00F6DB7B
DispatchMessageW.USER32(?), ref: 00F6DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F6DB9F
Sleep.KERNELBASE(0000000A), ref: 00F6DBB1

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: e0f9bd18e8f67607df146628d5df42478b7c50fbaa16047310aabccf395615eb
Instruction ID: dfe1879a015fcbc6481d94e7364077e6797c774769929aa8a7616f3a4e9985d8
Opcode Fuzzy Hash: e0f9bd18e8f67607df146628d5df42478b7c50fbaa16047310aabccf395615eb
Instruction Fuzzy Hash: 35420131B08346DFD738CF25C894BAABBE4BF85314F188619E49587291D778E844EF82

Function 00F62CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F62D07
RegisterClassExW.USER32(00000030), ref: 00F62D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F62D42
InitCommonControlsEx.COMCTL32(?), ref: 00F62D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F62D6F
LoadIconW.USER32(000000A9), ref: 00F62D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F62D94

Strings

+, xrefs: 00F62CF0
0, xrefs: 00F62CE9
TaskbarCreated, xrefs: 00F62D37
AutoIt v3 GUI, xrefs: 00F62D23

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 5fd4bc76126efe293bba388400548f54d3acec3cde81fa279a83199e5dc8382f
Instruction ID: 84d69dc1f353dba400c05a568014186ec7b842d91639971af47e0b7440668c23
Opcode Fuzzy Hash: 5fd4bc76126efe293bba388400548f54d3acec3cde81fa279a83199e5dc8382f
Instruction Fuzzy Hash: 1121E3B190122CEFDB10DFA4E949BEDBBB8FB0C700F00811AF651A6290D7B65544DF91

Function 00FA065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FA039A: CreateFileW.KERNELBASE(00000000,00000000,?,00FA0704,?,?,00000000,?,00FA0704,00000000,0000000C), ref: 00FA03B7

GetLastError.KERNEL32 ref: 00FA076F
__dosmaperr.LIBCMT ref: 00FA0776
GetFileType.KERNELBASE(00000000), ref: 00FA0782
GetLastError.KERNEL32 ref: 00FA078C
__dosmaperr.LIBCMT ref: 00FA0795
CloseHandle.KERNEL32(00000000), ref: 00FA07B5
CloseHandle.KERNEL32(?), ref: 00FA08FF
GetLastError.KERNEL32 ref: 00FA0931
__dosmaperr.LIBCMT ref: 00FA0938

Strings

H, xrefs: 00FA08BD

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: ce91ef847190d702750fe59cd48bee29739b0a0e69a46bb655a0f6066863db93
Instruction ID: 1f88427e341262bd4edbad54ba6a994561fd8f70be485778daaf7e0ee2a34360
Opcode Fuzzy Hash: ce91ef847190d702750fe59cd48bee29739b0a0e69a46bb655a0f6066863db93
Instruction Fuzzy Hash: A2A12572E001088FDF19EF68EC51BAE7BB4AB06324F140159F815EB391DB399D16EB91

Function 00F6344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F63A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,01031418,?,00F62E7F,?,?,?,00000000), ref: 00F63A78

Part of subcall function 00F63357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F63379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00F6356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00FA318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00FA31CE
RegCloseKey.ADVAPI32(?), ref: 00FA3210
_wcslen.LIBCMT ref: 00FA3277
_wcslen.LIBCMT ref: 00FA3286

Strings

\, xrefs: 00FA328C
Software\AutoIt v3\AutoIt, xrefs: 00F63560
\Include\, xrefs: 00F63527
Include, xrefs: 00FA3184, 00FA31C5

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 42d812d7f36a4a3f47ef4f550c749a64575879f67b7c6f3c0e36e46b59f0d7e1
Instruction ID: 92ca5539a54c11018c8349cf326123261f9432c7cb6ee97ed6bd52bb235f87bf
Opcode Fuzzy Hash: 42d812d7f36a4a3f47ef4f550c749a64575879f67b7c6f3c0e36e46b59f0d7e1
Instruction Fuzzy Hash: A771B1B14083059EC324EF65EC819ABBBECFF85750F40842EF585D3164EB759A48EB62

Function 00F62B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F62B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00F62B9D
LoadIconW.USER32(00000063), ref: 00F62BB3
LoadIconW.USER32(000000A4), ref: 00F62BC5
LoadIconW.USER32(000000A2), ref: 00F62BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F62BEF
RegisterClassExW.USER32(?), ref: 00F62C40

Part of subcall function 00F62CD4: GetSysColorBrush.USER32(0000000F), ref: 00F62D07
Part of subcall function 00F62CD4: RegisterClassExW.USER32(00000030), ref: 00F62D31
Part of subcall function 00F62CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F62D42
Part of subcall function 00F62CD4: InitCommonControlsEx.COMCTL32(?), ref: 00F62D5F
Part of subcall function 00F62CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F62D6F
Part of subcall function 00F62CD4: LoadIconW.USER32(000000A9), ref: 00F62D85
Part of subcall function 00F62CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F62D94

Strings

0, xrefs: 00F62C0F
AutoIt v3, xrefs: 00F62C2F
#, xrefs: 00F62C16

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 24d0762ced30dd2c58771f0adee3331e1644134039fde21498537f3bdbd9ace9
Instruction ID: 76cb2c7e95930bee1813908ca568a0cfe09b0830944a7383c67206ad7470d3b1
Opcode Fuzzy Hash: 24d0762ced30dd2c58771f0adee3331e1644134039fde21498537f3bdbd9ace9
Instruction Fuzzy Hash: 74214972E0031CABDB209FA6ED45AA97FB9FB0CB50F04801AE640A6694D7BA0540DF90

Function 00F63170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00F6316A,?,?), ref: 00F631D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00F6316A,?,?), ref: 00F63204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F63227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00F6316A,?,?), ref: 00F63232
CreatePopupMenu.USER32 ref: 00F63246
PostQuitMessage.USER32(00000000), ref: 00F63267

Strings

TaskbarCreated, xrefs: 00F6322D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: f65d2cc030a1797539b4f6f7023d49b49f8ccb298f5bc08d505782d4edb94d1f
Instruction ID: a21359615a8b9b1fe0622b80d247c670b2535feaa09902697ceceac07ea1458f
Opcode Fuzzy Hash: f65d2cc030a1797539b4f6f7023d49b49f8ccb298f5bc08d505782d4edb94d1f
Instruction Fuzzy Hash: 3E412A36B44208A7DB242B7CDD5EB793A5DFB4A360F04411AF642C6291CB7A9F40F7A1

Function 00F62C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F62C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F62CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00F61CAD,?), ref: 00F62CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00F61CAD,?), ref: 00F62CCF

Strings

AutoIt v3, xrefs: 00F62C89, 00F62C8E, 00F62C8F
edit, xrefs: 00F62CAC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 4e6d8f1cdcf5c96dfc1b16f897bf5ee1af107fa4eaeb9278c06786d9461577e9
Instruction ID: 348be1e248d80de7b5d157dacface8343392a4d1623331f1f6e6e2f33a8871ee
Opcode Fuzzy Hash: 4e6d8f1cdcf5c96dfc1b16f897bf5ee1af107fa4eaeb9278c06786d9461577e9
Instruction Fuzzy Hash: CBF0D0755402A87AE73117176C08E777EBDDBCBF50B004059FA4093554C6B61854EFB0

Function 00FCE97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00FCE997
QueryPerformanceFrequency.KERNEL32(?), ref: 00FCE9A5
Sleep.KERNEL32(00000000), ref: 00FCE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00FCE9B7
Sleep.KERNELBASE ref: 00FCE9F3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 6c6188321386d2cc4bce6cc8332edc19b2797a8e7c226dff87058de64e82edf0
Instruction ID: 1826386b7367b3a2e809d554b930c185a5a9c071aa69377b0b82240f3d8a1197
Opcode Fuzzy Hash: 6c6188321386d2cc4bce6cc8332edc19b2797a8e7c226dff87058de64e82edf0
Instruction Fuzzy Hash: BB015731D0162EDBCF00ABE5DA4ABEDBB78FF09310F00054AE502B2241CB349655EBA2

Function 00F63B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00F63B0F,SwapMouseButtons,00000004,?), ref: 00F63B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00F63B0F,SwapMouseButtons,00000004,?), ref: 00F63B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00F63B0F,SwapMouseButtons,00000004,?), ref: 00F63B83

Strings

Control Panel\Mouse, xrefs: 00F63B3E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 78f1fb67c38e573daf3a3b709db92912ee256c5858174d2358e42b967dfdf1f4
Instruction ID: 41b4a7e56077338f015094b5b903fdcf2678fec205fb29ba001e6091d7cf0f0a
Opcode Fuzzy Hash: 78f1fb67c38e573daf3a3b709db92912ee256c5858174d2358e42b967dfdf1f4
Instruction Fuzzy Hash: 2B115AB1910218FFDB208FA4DC44EEEBBBCEF41750B104459A801D7110D6319E40A7A0

Function 00F63923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00FA33A2

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F63A04

Strings

Line: , xrefs: 00FA33EB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 715bbec4766f7d33adc27386e077fe34a657565f291b965f1814936bdce3e81a
Instruction ID: 1b728ed1e653d6b5faef53d4812b71f64d3b68a7fed8e024368e3a3f02d66446
Opcode Fuzzy Hash: 715bbec4766f7d33adc27386e077fe34a657565f291b965f1814936bdce3e81a
Instruction Fuzzy Hash: A831C671808314AAD725EB20DC46BEBB7ECAF45710F04452EF5D993181EB789649EBC2

Function 00F7FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F80668

Part of subcall function 00F832A4: RaiseException.KERNEL32(?,?,?,00F8068A,?,01031444,?,?,?,?,?,?,00F8068A,00F61129,01028738,00F61129), ref: 00F83304

__CxxThrowException@8.LIBVCRUNTIME ref: 00F80685

Strings

Unknown exception, xrefs: 00F80692

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 8e844ca6b1f37a99066961a99f87ee2fa85449e255804a1e64a5aa61e163b1e2
Instruction ID: d31fe56e659bf93b07769c1d2ba2047df5ec521f79cdcbb06cf39f59f300abb4
Opcode Fuzzy Hash: 8e844ca6b1f37a99066961a99f87ee2fa85449e255804a1e64a5aa61e163b1e2
Instruction Fuzzy Hash: BBF0C834D0020D778F10B664DC4ADDD776C5E00720B908536B928955A1FF75DA2DE791

Function 00F610F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F61BF4
Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00F61BFC
Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F61C07
Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F61C12
Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00F61C1A
Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00F61C22

Part of subcall function 00F61B4A: RegisterWindowMessageW.USER32(00000004,?,00F612C4), ref: 00F61BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00F6136A
OleInitialize.OLE32 ref: 00F61388
CloseHandle.KERNEL32(00000000,00000000), ref: 00FA24AB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 5fd91821cdb2a595bc86005e04a28c6f2eb9f5f2f7ebde01224990827d47438b
Instruction ID: 8e7c5a755f6e282b57d6258ddffa69366015732e2650737d843da2a82b3ee22f
Opcode Fuzzy Hash: 5fd91821cdb2a595bc86005e04a28c6f2eb9f5f2f7ebde01224990827d47438b
Instruction Fuzzy Hash: 8971BAB5901204CFC3A4DF79E9456653AECBB8D340358862AD1CAD739AEB3A4401EF95

Function 00FCC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F63923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F63A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FCC259
KillTimer.USER32(?,00000001,?,?), ref: 00FCC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00FCC270

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: dd02364acfb9b6c7ddfcc3e73e5f9bb991fe98209f31014191005f4fcd96d828
Instruction ID: c65a5c4757060121fac812d0e1a84d33c804f47700e551dc15fe1600017f9e14
Opcode Fuzzy Hash: dd02364acfb9b6c7ddfcc3e73e5f9bb991fe98209f31014191005f4fcd96d828
Instruction Fuzzy Hash: FC31C371D04354AFEB329F648996BE7BBEC9F06304F04049ED1DE93241C3745A84DB91

Function 00F986AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00F985CC,?,01028CC8,0000000C), ref: 00F98704
GetLastError.KERNEL32(?,00F985CC,?,01028CC8,0000000C), ref: 00F9870E
__dosmaperr.LIBCMT ref: 00F98739

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: dd68894b621a9ce36fd3bed5aa9a04c9942cc6c9e272d6453c8688b9dcd0790e
Instruction ID: 3e5574174bc4b58f5a7d9eb80f3303399e688b92a4bc9f66dc5815d7a541758b
Opcode Fuzzy Hash: dd68894b621a9ce36fd3bed5aa9a04c9942cc6c9e272d6453c8688b9dcd0790e
Instruction Fuzzy Hash: 66014C33E051201AFE216234DC45B7E374A4B83BF4F250119F8048F0D2DD658C82F290

Function 00F9CE40 Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00F9CE44
_free.LIBCMT ref: 00F9CE7D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F9CE84

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free_free
String ID:
API String ID: 2716640707-0
Opcode ID: dd345ce9d0d3d2f785d6683852fa7f515bf6f2fe6d6f2b7c41f672c94250c437
Instruction ID: aba4a4945f1dacb6341a99a53149ddeec4b05fc99fb237942384d8385633a063
Opcode Fuzzy Hash: dd345ce9d0d3d2f785d6683852fa7f515bf6f2fe6d6f2b7c41f672c94250c437
Instruction Fuzzy Hash: 78E02B7790442627F62233397C89D7F3A1DDFC27B07150025F409D2182DE148D06B1F0

Function 00F6DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00F6DB7B
DispatchMessageW.USER32(?), ref: 00F6DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F6DB9F
Sleep.KERNELBASE(0000000A), ref: 00F6DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00FB1CC9

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 2ec9428b838e0dd7e181fb650af10bd0c2c38de938c1193adb3d64be2cd8fd24
Instruction ID: 1461e376983cc97ca40ab1653c7d1951dd0448299a7976eb544a0eb38b00d326
Opcode Fuzzy Hash: 2ec9428b838e0dd7e181fb650af10bd0c2c38de938c1193adb3d64be2cd8fd24
Instruction Fuzzy Hash: DFF05E31A043489BE730DBA1DC99FEA73ACEF88320F504A19E65A830C0DB34A448EB55

Function 00F71310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00F717F6

Strings

CALL, xrefs: 00F717C6

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 9e303addaa6e253e623cb5423f9fb28715a193df7ac5b1ebd100586646f2a8ef
Instruction ID: 7bf62595d68c80e99a9b47f4dc9b544bec98cf9b74119aca64d364ed3bcfede9
Opcode Fuzzy Hash: 9e303addaa6e253e623cb5423f9fb28715a193df7ac5b1ebd100586646f2a8ef
Instruction Fuzzy Hash: 52228C706082019FC714DF19C880B6ABBF1BF85314F18892EF49A8B361D775E959EF92

Function 00F62DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00FA2C8C

Part of subcall function 00F63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F63A97,?,?,00F62E7F,?,?,?,00000000), ref: 00F63AC2

Part of subcall function 00F62DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00F62DC4

Strings

X, xrefs: 00FA2C5A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 29d2809a03f17bd146b3dc5ff4e50e216fd6f789551875d99b2f8f215db8d3b1
Instruction ID: 75a88a054d4a0bb645dc1ac48168ab98717d8d5db26ec2d8e48c6335d0db8457
Opcode Fuzzy Hash: 29d2809a03f17bd146b3dc5ff4e50e216fd6f789551875d99b2f8f215db8d3b1
Instruction Fuzzy Hash: 3D21C371A002989FCB41EF94CC45BEE7BFCAF49314F008059E445E7241DBB89A899BA1

Function 00F63837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F63908

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 7dde567a25bcf4277d42ead1815b83306aa47d6a6b23e4a299daa61c4be962cb
Instruction ID: 952078165fdba8b41d2776b5634607993b8345d1206f2312628f07a87e0454f5
Opcode Fuzzy Hash: 7dde567a25bcf4277d42ead1815b83306aa47d6a6b23e4a299daa61c4be962cb
Instruction Fuzzy Hash: 02314CB19047019FD720DF34D985797BBE8FB49718F00092EF59A87240E775AA44DB92

Function 00F7F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F7F661

Part of subcall function 00F6D730: GetInputState.USER32 ref: 00F6D807

Sleep.KERNEL32(00000000), ref: 00FBF2DE

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 8e1e591ef9de7451ce3f5be8accfe29a4105c0111648d20c0c58c046eb6d3094
Instruction ID: 68b9850ada15d5dba2c023462f2856b87591174f2f3dbc88fda0360192c4fff9
Opcode Fuzzy Hash: 8e1e591ef9de7451ce3f5be8accfe29a4105c0111648d20c0c58c046eb6d3094
Instruction Fuzzy Hash: 78F08C312402199FD310EF6AD949BAAB7E8EF45760F00402AE85AC7361EB70AC44EB91

Function 00F6B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00F6BB4E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: bf855b90655e92a3efad29c50a0b1a8716be29e2e1f9b5eea51929c6acf862c0
Instruction ID: dab86ffed8ccbc2cca3a2f0f6e522a716f58f4b9d10372311acf3200eb9aa5ec
Opcode Fuzzy Hash: bf855b90655e92a3efad29c50a0b1a8716be29e2e1f9b5eea51929c6acf862c0
Instruction Fuzzy Hash: F832CE31E00209DFDB24CF59C894BBEB7B9EF44320F188059E945AB251DB78ED81EB91

Function 00FF2598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00FF2649

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 60ba5fb47f131a164283a02090566296fa092a88e50099dfe813d5b867634889
Instruction ID: 643a97565b1c963c5972b1d72593dcfaf51f19c813a49772413745dee41e5e8d
Opcode Fuzzy Hash: 60ba5fb47f131a164283a02090566296fa092a88e50099dfe813d5b867634889
Instruction Fuzzy Hash: B521047520061DAFD790DF14CCD0D36B799EF44368B18806CE9968B3A2CB71ED41EB90

Function 00FF13B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00FF1420

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 7d6342cbe008e8bffa5b522ca9b0ee1f67b02eb39c1501c54fae691f085d902c
Instruction ID: 7df2264db5a2e5efed4ff7cdf60a93bca8e7ae3da4a1a9ef1ecbe7de38796e0f
Opcode Fuzzy Hash: 7d6342cbe008e8bffa5b522ca9b0ee1f67b02eb39c1501c54fae691f085d902c
Instruction Fuzzy Hash: 3931A031604206EFD714EF25C891B79B7A2FF85324F048168E8554B3A2DB79EC51DBD0

Function 00F64ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F64E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F64EDD,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E9C
Part of subcall function 00F64E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F64EAE
Part of subcall function 00F64E90: FreeLibrary.KERNEL32(00000000,?,?,00F64EDD,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64EFD

Part of subcall function 00F64E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00FA3CDE,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E62
Part of subcall function 00F64E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F64E74
Part of subcall function 00F64E59: FreeLibrary.KERNEL32(00000000,?,?,00FA3CDE,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E87

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 137486708e12e521c0f6f221778cb0e215862395e637dd0152bdad09d4d00c5a
Instruction ID: ea95290e7c58d94e5ea4161523f6b8cc2380b0b70ebfcf25a9c1ea36f1bba966
Opcode Fuzzy Hash: 137486708e12e521c0f6f221778cb0e215862395e637dd0152bdad09d4d00c5a
Instruction Fuzzy Hash: 5211E332600205AACB15BB60DD12FAD77A5AF50B10F20842EF552BB1D1EE79EA05B790

Function 00F98402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F98440

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 80bf7133fed6d1bbb014737809a643240b0c9435b6e4f375691a2d14bac97e11
Instruction ID: 99914b99ead42c021da0ba9778932192c77da65a17efbb604cef9faa6d855f3a
Opcode Fuzzy Hash: 80bf7133fed6d1bbb014737809a643240b0c9435b6e4f375691a2d14bac97e11
Instruction Fuzzy Hash: A411487190410AAFDF05DF58E9409DA7BF8EF49310F104069F808AB302DA31EA12DBA4

Function 00FF29BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00FF14B5,?), ref: 00FF2A01

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 9fb1d4fa994e4861e1b7272cac4afd5aa8756cd9f8e77b9e72d4aea317a2fb63
Instruction ID: 6e0e7426bb5ca079a6427c3f2efa4d07dd947d8fece81d2ad507142460a50d79
Opcode Fuzzy Hash: 9fb1d4fa994e4861e1b7272cac4afd5aa8756cd9f8e77b9e72d4aea317a2fb63
Instruction Fuzzy Hash: 6D01B536700A459FD3B5CA2CC494B323792EF85324F298468C2478B2A1D776FC42E7A0

Function 00F8E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 034af56f1f80d79cb64f24f8bc37238d5dece84bcd38400c83e79ca745bfdca6
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 70F02D32520A14A6EB313A69CC05BD633989F52370F140715F424931E1EB78D802BBA5

Function 00FF149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00FF14EB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 1c3e534f54227d4356d6e51957fcc7e6489639e54079dc89686f59dece18f891
Instruction ID: 109036ad614d0cf185f6a258d4b9b44ceedf32bb30c0657befd03133f5122a4b
Opcode Fuzzy Hash: 1c3e534f54227d4356d6e51957fcc7e6489639e54079dc89686f59dece18f891
Instruction Fuzzy Hash: 7E01F735704759DFD320DF69C840836BB95FF85324754809DE94A8B762E672DD82DBC0

Function 00F93820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6,?,00F61129), ref: 00F93852

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c5470d5f91f2888711357c34c89f8ec39373c486420a4ef545fa37edf63cfb11
Instruction ID: 301c0398b1d12ac4543e13524f994d33fa646c9769cf81345e982de871cc3761
Opcode Fuzzy Hash: c5470d5f91f2888711357c34c89f8ec39373c486420a4ef545fa37edf63cfb11
Instruction Fuzzy Hash: EFE0E53390022956FE3136679C05BDA364DAF827B0F050021BC4592881CB26ED01B2E0

Function 00F64F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64F6D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4539b77ceeddaa3f062f4ea036a9f585b9255874aeaba3d8b19ee3142d68e15e
Instruction ID: 02a530697774f5030d043821ffbd33b766ab7e418528cf6ac711af1f397c15ce
Opcode Fuzzy Hash: 4539b77ceeddaa3f062f4ea036a9f585b9255874aeaba3d8b19ee3142d68e15e
Instruction Fuzzy Hash: 1DF03071505751CFDB38AF64D890922B7E4AF14329310897EE1EA83511C731A854FF50

Function 00FF2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00FF2A66

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 4b039a1a4cc7e19b2f701ccef31c2d12322819da4929317687121e093ad8ff5c
Instruction ID: 0314b120efe6fc84c01b5d7cda7d19a2165c01eff4ca145b4ce4cbbb95bafc3d
Opcode Fuzzy Hash: 4b039a1a4cc7e19b2f701ccef31c2d12322819da4929317687121e093ad8ff5c
Instruction Fuzzy Hash: 09E0DF3235011BAAC750EA30EC80AFA735CEF10390700443AAD1AC2110EF389981F2E0

Function 00F62DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00F62DC4

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 49bf17cfe03719d4ba3bf6c42ccb9df36506d76ba503e396e59cf5dedd5bf3e9
Instruction ID: 0e174b7698ab64367e5b8d1ed2649cd34d8be1fb17fa0dbab67904f2676f9902
Opcode Fuzzy Hash: 49bf17cfe03719d4ba3bf6c42ccb9df36506d76ba503e396e59cf5dedd5bf3e9
Instruction Fuzzy Hash: 23E0CD766001285BC71096589C05FEA77DDDFC8790F054071FD09D7248D964AD80D590

Function 00F62B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F63837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F63908

Part of subcall function 00F6D730: GetInputState.USER32 ref: 00F6D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00F62B6B

Part of subcall function 00F630F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00F6314E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 83fc1532c6a87588608bece3aa28f596792b729a9484c754b8700af091356f86
Instruction ID: cceef5f086f730ebb53a2b829569b8e3ce6a74679916b5bf0f94680684424b48
Opcode Fuzzy Hash: 83fc1532c6a87588608bece3aa28f596792b729a9484c754b8700af091356f86
Instruction Fuzzy Hash: 13E0863270424816CA08BB75AC525BDB75DDBD5355F40153EF58243193CE7D4549B352

Function 00FC3D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00FC3D18

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 0242515573bb3ed81be5022f02755060b2861f195e2c837d2316a0ecc8de89b3
Instruction ID: cad73a3f86cecef478d39e8c4cc47ca0d53dced9744078b04b96db91f96a3e6f
Opcode Fuzzy Hash: 0242515573bb3ed81be5022f02755060b2861f195e2c837d2316a0ecc8de89b3
Instruction Fuzzy Hash: C8D012E06A430C7EFB0083728D0BEBB329CCB16A81F004BA47A02D64C1D9A0DE084170

Function 00FA039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00FA0704,?,?,00000000,?,00FA0704,00000000,0000000C), ref: 00FA03B7

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6d933f6e4218e3e62f4cb31975682c483bc20f1232f69816c3e7388951bcd8bc
Instruction ID: 9e57ee549ef9194df0cba0ca36cae6d41412cf241dc8f0fd684a48a538fa05a5
Opcode Fuzzy Hash: 6d933f6e4218e3e62f4cb31975682c483bc20f1232f69816c3e7388951bcd8bc
Instruction Fuzzy Hash: 81D06C3204010DBBDF028F84DD06EDA3BAAFB48714F014000BE1856020C732E831EB90

Function 00F61CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00F61CBC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 8d2a35052a89b04135a92142a89d368fdbe7d9f22858d7d88eac6e16bd53cf57
Instruction ID: c3e488cbde7e7607b438f4e93f4cc547b5adf5e3450a62f8074c016db2f356f7
Opcode Fuzzy Hash: 8d2a35052a89b04135a92142a89d368fdbe7d9f22858d7d88eac6e16bd53cf57
Instruction Fuzzy Hash: D6C09B35280308DFF2244780BD4AF10775DA74CB01F088001F649555D7C7B71454E750

Non-executed Functions

Function 00FF9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00FF961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FF965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00FF969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FF96C9
SendMessageW.USER32 ref: 00FF96F2
GetKeyState.USER32(00000011), ref: 00FF978B
GetKeyState.USER32(00000009), ref: 00FF9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FF97AE
GetKeyState.USER32(00000010), ref: 00FF97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FF97E9
SendMessageW.USER32 ref: 00FF9810
SendMessageW.USER32(?,00001030,?,00FF7E95), ref: 00FF9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00FF992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00FF9941
SetCapture.USER32(?), ref: 00FF994A
ClientToScreen.USER32(?,?), ref: 00FF99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00FF99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FF99D6
ReleaseCapture.USER32 ref: 00FF99E1
GetCursorPos.USER32(?), ref: 00FF9A19
ScreenToClient.USER32(?,?), ref: 00FF9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00FF9A80
SendMessageW.USER32 ref: 00FF9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00FF9AEB
SendMessageW.USER32 ref: 00FF9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00FF9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00FF9B4A
GetCursorPos.USER32(?), ref: 00FF9B68
ScreenToClient.USER32(?,?), ref: 00FF9B75
GetParent.USER32(?), ref: 00FF9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00FF9BFA
SendMessageW.USER32 ref: 00FF9C2B
ClientToScreen.USER32(?,?), ref: 00FF9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00FF9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00FF9CDE
SendMessageW.USER32 ref: 00FF9D01
ClientToScreen.USER32(?,?), ref: 00FF9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00FF9D82

Part of subcall function 00F79944: GetWindowLongW.USER32(?,000000EB), ref: 00F79952

GetWindowLongW.USER32(?,000000F0), ref: 00FF9E05

Strings

@GUI_DRAGID, xrefs: 00FF997D
F, xrefs: 00FF9D07

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 4d2aefad44f228f7cd20050acc3c1f02202a6b47ca35af233e5d3aebf51de2ad
Instruction ID: ffe7a28276bc0da6038f0ecdba1ae116811538a4227ddfedd58577ebffeafd33
Opcode Fuzzy Hash: 4d2aefad44f228f7cd20050acc3c1f02202a6b47ca35af233e5d3aebf51de2ad
Instruction Fuzzy Hash: 90427B35608209AFD724DF24CC44BBABBE9FF48720F140619F699C72B1D7B1A854EB91

Function 00FF4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00FF48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00FF4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00FF4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00FF494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00FF495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00FF497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00FF49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00FF49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00FF4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00FF4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00FF4A7E
IsMenu.USER32(?), ref: 00FF4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FF4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FF4B20
GetWindowLongW.USER32(?,000000F0), ref: 00FF4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00FF4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00FF4C82
wsprintfW.USER32 ref: 00FF4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FF4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00FF4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00FF4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FF4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00FF4D5A

Strings

%d/%02d/%02d, xrefs: 00FF4CA8

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 653e28a1b4d0740e48c602e2dff2384bab401ec47f183ab402d49b55e17bc881
Instruction ID: 101681989dffebfcd5ecec1451b468400b16a28971b98d48947e2daa4c7a1bc1
Opcode Fuzzy Hash: 653e28a1b4d0740e48c602e2dff2384bab401ec47f183ab402d49b55e17bc881
Instruction Fuzzy Hash: F212CF71A0025CABEB248F28CD49FBF7BB8AF45720F144119F619DB2E1D778A941EB50

Function 00F7F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00F7F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FBF474
IsIconic.USER32(00000000), ref: 00FBF47D
ShowWindow.USER32(00000000,00000009), ref: 00FBF48A
SetForegroundWindow.USER32(00000000), ref: 00FBF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FBF4AA
GetCurrentThreadId.KERNEL32 ref: 00FBF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FBF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FBF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FBF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00FBF4DE
SetForegroundWindow.USER32(00000000), ref: 00FBF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBF4F6
keybd_event.USER32(00000012,00000000), ref: 00FBF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBF50B
keybd_event.USER32(00000012,00000000), ref: 00FBF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBF519
keybd_event.USER32(00000012,00000000), ref: 00FBF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBF528
keybd_event.USER32(00000012,00000000), ref: 00FBF52D
SetForegroundWindow.USER32(00000000), ref: 00FBF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00FBF557

Strings

Shell_TrayWnd, xrefs: 00FBF46F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: b9b694eeec7fbd353c9f377d42eafb645bae19c31f77e8a26a1540cac6e14130
Instruction ID: c590db536b40c1f019ef154ed21a806dcb1e8f73875e22bacdb4b018f9a2308b
Opcode Fuzzy Hash: b9b694eeec7fbd353c9f377d42eafb645bae19c31f77e8a26a1540cac6e14130
Instruction Fuzzy Hash: B6313271A4022CBAEB206BB65D49FBF7E6CEF44B50F140065F605E61D1C6B15900FEA0

Function 00FC1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00FC16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FC170D
Part of subcall function 00FC16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FC173A
Part of subcall function 00FC16C3: GetLastError.KERNEL32 ref: 00FC174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00FC1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00FC12A8
CloseHandle.KERNEL32(?), ref: 00FC12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00FC12D1
GetProcessWindowStation.USER32 ref: 00FC12EA
SetProcessWindowStation.USER32(00000000), ref: 00FC12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00FC1310

Part of subcall function 00FC10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FC11FC), ref: 00FC10D4
Part of subcall function 00FC10BF: CloseHandle.KERNEL32(?,?,00FC11FC), ref: 00FC10E9

Strings

, xrefs: 00FC125A
default, xrefs: 00FC130B
winsta0, xrefs: 00FC12CC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 5261eb2d1431f54db2b73d5505014b24dcc69a3aeeb228ae251dafe5e98c2ebb
Instruction ID: e875078345f5370c56f9f1cf6e1122c6265b0836959ff8e77d9af3bd2db0577c
Opcode Fuzzy Hash: 5261eb2d1431f54db2b73d5505014b24dcc69a3aeeb228ae251dafe5e98c2ebb
Instruction Fuzzy Hash: C1819C7190020EABDF25DFA4DE4AFEE7BB9BF06710F144069F910E61A1D7348964EB60

Function 00FC0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FC1114
Part of subcall function 00FC10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1120
Part of subcall function 00FC10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC112F
Part of subcall function 00FC10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1136
Part of subcall function 00FC10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FC114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FC0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FC0C00
GetLengthSid.ADVAPI32(?), ref: 00FC0C17
GetAce.ADVAPI32(?,00000000,?), ref: 00FC0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FC0C6D
GetLengthSid.ADVAPI32(?), ref: 00FC0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00FC0C8C
HeapAlloc.KERNEL32(00000000), ref: 00FC0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FC0CB4
CopySid.ADVAPI32(00000000), ref: 00FC0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FC0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FC0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FC0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0D45
HeapFree.KERNEL32(00000000), ref: 00FC0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0D55
HeapFree.KERNEL32(00000000), ref: 00FC0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0D65
HeapFree.KERNEL32(00000000), ref: 00FC0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00FC0D78
HeapFree.KERNEL32(00000000), ref: 00FC0D7F

Part of subcall function 00FC1193: GetProcessHeap.KERNEL32(00000008,00FC0BB1,?,00000000,?,00FC0BB1,?), ref: 00FC11A1
Part of subcall function 00FC1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00FC0BB1,?), ref: 00FC11A8
Part of subcall function 00FC1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00FC0BB1,?), ref: 00FC11B7

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 08c6974827f5c6bb7a794e5b8705d5f80f1a590d20ea2fdce19e1eeb59258446
Instruction ID: 9d9a67badaa5cc6c1faa0edafdf159dfe8906bfd368fdefbe386d53cf3244391
Opcode Fuzzy Hash: 08c6974827f5c6bb7a794e5b8705d5f80f1a590d20ea2fdce19e1eeb59258446
Instruction Fuzzy Hash: FE71897290021EEBDF10DFA5DE45FAEBBBCAF04710F044219E905E6191DB70A906EBA0

Function 00FDEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00FFCC08), ref: 00FDEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00FDEB37
GetClipboardData.USER32(0000000D), ref: 00FDEB43
CloseClipboard.USER32 ref: 00FDEB4F
GlobalLock.KERNEL32(00000000), ref: 00FDEB87
CloseClipboard.USER32 ref: 00FDEB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00FDEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00FDEBC9
GetClipboardData.USER32(00000001), ref: 00FDEBD1
GlobalLock.KERNEL32(00000000), ref: 00FDEBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00FDEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00FDEC38
GetClipboardData.USER32(0000000F), ref: 00FDEC44
GlobalLock.KERNEL32(00000000), ref: 00FDEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00FDEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00FDEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00FDECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00FDECF3
CountClipboardFormats.USER32 ref: 00FDED14
CloseClipboard.USER32 ref: 00FDED59

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: dfb8a4ae83fbd41870dce61ed26a04b52d372833241fa5cce1a6cba793a286c0
Instruction ID: d54bba9d61d1a6178541f47c296f89dc6f874d9aeca6e4532dbbc5f80030de44
Opcode Fuzzy Hash: dfb8a4ae83fbd41870dce61ed26a04b52d372833241fa5cce1a6cba793a286c0
Instruction Fuzzy Hash: 6F61AE3520420A9FD300EF20CD85F3A77AAEF84714F18455EF4569B3A1DB71E909EBA2

Function 00FD698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FD69BE
FindClose.KERNEL32(00000000), ref: 00FD6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FD6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FD6A75

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00FD6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FD6ADF

Strings

%02d, xrefs: 00FD6C00, 00FD6C0A, 00FD6C5A, 00FD6CAA, 00FD6CFA, 00FD6D4A
%03d, xrefs: 00FD6DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00FD6B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00FD6B32
%4d, xrefs: 00FD6BB1

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 091af7fe37c12c4b3bd690df9f84783e0f31255e18a23b86dcffe0472cdbb758
Instruction ID: d2b6310785e3108571e4807c0b6f8f798604c9b30422cdd5ee289959f92fd02e
Opcode Fuzzy Hash: 091af7fe37c12c4b3bd690df9f84783e0f31255e18a23b86dcffe0472cdbb758
Instruction Fuzzy Hash: A9D15172508340AFC310EBA4CD81EABB7ECAF98704F44491EF585C7251EB79DA48DB62

Function 00FD9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FD9663
GetFileAttributesW.KERNEL32(?), ref: 00FD96A1
SetFileAttributesW.KERNEL32(?,?), ref: 00FD96BB
FindNextFileW.KERNEL32(00000000,?), ref: 00FD96D3
FindClose.KERNEL32(00000000), ref: 00FD96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00FD96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD974A
SetCurrentDirectoryW.KERNEL32(01026B7C), ref: 00FD9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FD9772
FindClose.KERNEL32(00000000), ref: 00FD977F
FindClose.KERNEL32(00000000), ref: 00FD978F

Strings

*.*, xrefs: 00FD96F5

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: f602a8d4e23be2c8076140a9767cc2d511d3d06d88c5583db2a1c10521c615fa
Instruction ID: e977988479ecd1e1d2a12eabc13df305a8a950107bfb2c42bad88e4d755b4a23
Opcode Fuzzy Hash: f602a8d4e23be2c8076140a9767cc2d511d3d06d88c5583db2a1c10521c615fa
Instruction Fuzzy Hash: 3231E23294422D6BDF14AFF4DD48AEE77AD9F49320F184196F814E22A0DB74D984EB50

Function 00FD979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FD97BE
FindNextFileW.KERNEL32(00000000,?), ref: 00FD9819
FindClose.KERNEL32(00000000), ref: 00FD9824
FindFirstFileW.KERNEL32(*.*,?), ref: 00FD9840
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD9890
SetCurrentDirectoryW.KERNEL32(01026B7C), ref: 00FD98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FD98B8
FindClose.KERNEL32(00000000), ref: 00FD98C5
FindClose.KERNEL32(00000000), ref: 00FD98D5

Part of subcall function 00FCDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00FCDB00

Strings

*.*, xrefs: 00FD983B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 1bca7be9dd6baa78de285cbf02471200e56f2e54783cbe89aef40170adc7f5bc
Instruction ID: 3fc9e2a62f32a16d788cd005bcde46542560cefb84e5dfdb8dc22318720c9652
Opcode Fuzzy Hash: 1bca7be9dd6baa78de285cbf02471200e56f2e54783cbe89aef40170adc7f5bc
Instruction Fuzzy Hash: 1831E53294422D6EDF10AFF4EC48AEE77AD9F46730F184156E850A22A0DB71D984FB60

Function 00FEBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FEB6AE,?,?), ref: 00FEC9B5
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FEC9F1
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA68
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FEBF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00FEBFA9
RegCloseKey.ADVAPI32(00000000), ref: 00FEBFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00FEC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00FEC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00FEC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00FEC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00FEC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00FEC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00FEC382
RegCloseKey.ADVAPI32(00000000), ref: 00FEC38F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: cd0b5888e2a4f005b1f926e43476f743111668fba5c688d06f4e36b9057335dd
Instruction ID: 19d3922af325b2bd517e132c61e9f6c2643088802a809989d98f040700155976
Opcode Fuzzy Hash: cd0b5888e2a4f005b1f926e43476f743111668fba5c688d06f4e36b9057335dd
Instruction Fuzzy Hash: D00281716042409FC714DF25C891E2ABBE5EF89318F18C49DF84ACB2A2DB35EC46DB91

Function 00FD8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FD8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FD8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00FD8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FD8310
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD8324
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00FD838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD8395

Strings

*.*, xrefs: 00FD839B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: c588af45329f9d38b1f99453cb2a59b612e370912aae80fad414141916e84914
Instruction ID: d7cf4cb4a73982849fc2c610952438a6c6aed9615dba4a7f2c1f64b7a521627a
Opcode Fuzzy Hash: c588af45329f9d38b1f99453cb2a59b612e370912aae80fad414141916e84914
Instruction Fuzzy Hash: 0E618C725083459FC710EF60C8409AEB3E9FF89364F08491EF989C7251EB35E946EB92

Function 00FCD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F63A97,?,?,00F62E7F,?,?,?,00000000), ref: 00F63AC2

Part of subcall function 00FCE199: GetFileAttributesW.KERNEL32(?,00FCCF95), ref: 00FCE19A

FindFirstFileW.KERNEL32(?,?), ref: 00FCD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00FCD1DD
MoveFileW.KERNEL32(?,?), ref: 00FCD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00FCD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FCD237

Part of subcall function 00FCD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00FCD21C,?,?), ref: 00FCD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00FCD253
FindClose.KERNEL32(00000000), ref: 00FCD264

Strings

\*.*, xrefs: 00FCD0CD, 00FCD0D6, 00FCD0EB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 3cc9c0054e3d7c890e8645d478ba8c1f0de57aa02742958d7bdbf3b91824c76b
Instruction ID: de32029e9e33e6535be8f32b29c98776b2147d00ae4dda8e1fefab2c66d7d012
Opcode Fuzzy Hash: 3cc9c0054e3d7c890e8645d478ba8c1f0de57aa02742958d7bdbf3b91824c76b
Instruction Fuzzy Hash: 1A614A31C0511EAADF05EBA0CE92EEDB7B9AF55300F644169E40177191EB35AF09EB60

Function 00FDED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00FDED91
EmptyClipboard.USER32 ref: 00FDED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00FDEDAC
CloseClipboard.USER32 ref: 00FDEEA3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d4f045a2320b9e1b3a75d22ac88fb5707d6af92c56819dac14d10bae268c96a0
Instruction ID: 436d2902c3387ddeae9a194908a302247f17a7087945dc06fffe54c456cd101e
Opcode Fuzzy Hash: d4f045a2320b9e1b3a75d22ac88fb5707d6af92c56819dac14d10bae268c96a0
Instruction Fuzzy Hash: DA41BE35604625AFE320EF15D888B29BBE6EF44328F19C09AE4598F762C775EC41DBD0

Function 00FCE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FC170D
Part of subcall function 00FC16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FC173A
Part of subcall function 00FC16C3: GetLastError.KERNEL32 ref: 00FC174A

ExitWindowsEx.USER32(?,00000000), ref: 00FCE932

Strings

, xrefs: 00FCE920
SeShutdownPrivilege, xrefs: 00FCE902
, xrefs: 00FCE95C
@, xrefs: 00FCE925

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 6cbaa942b27f7b98c3d56d977e00e4a9bb096a4078814f9389a8eac77a7d84b1
Instruction ID: 15ef353b6498ed640b38b5546c5f5b988703892285b53e114bb65a5cfeca3e77
Opcode Fuzzy Hash: 6cbaa942b27f7b98c3d56d977e00e4a9bb096a4078814f9389a8eac77a7d84b1
Instruction Fuzzy Hash: 4A012633A1022AABEB6422B49E87FBF725CAB14750F140529FC03E30D2D9B55C40B2D4

Function 00FE1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00FE1276
WSAGetLastError.WSOCK32 ref: 00FE1283
bind.WSOCK32(00000000,?,00000010), ref: 00FE12BA
WSAGetLastError.WSOCK32 ref: 00FE12C5
closesocket.WSOCK32(00000000), ref: 00FE12F4
listen.WSOCK32(00000000,00000005), ref: 00FE1303
WSAGetLastError.WSOCK32 ref: 00FE130D
closesocket.WSOCK32(00000000), ref: 00FE133C

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 183c30f8a95a593d86678851cc5add335801bdfb854ed891e223907d409376c8
Instruction ID: 1a2125727a7f63275cee5a031a70a04ee60a584e4dbd5fdf146c041b86558bad
Opcode Fuzzy Hash: 183c30f8a95a593d86678851cc5add335801bdfb854ed891e223907d409376c8
Instruction Fuzzy Hash: 5C41E731A001549FD710DF66C988B69BBE5BF86328F188188D9568F3D6C771EC81DBE1

Function 00FCD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F63A97,?,?,00F62E7F,?,?,?,00000000), ref: 00F63AC2

Part of subcall function 00FCE199: GetFileAttributesW.KERNEL32(?,00FCCF95), ref: 00FCE19A

FindFirstFileW.KERNEL32(?,?), ref: 00FCD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00FCD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FCD481
FindClose.KERNEL32(00000000), ref: 00FCD498
FindClose.KERNEL32(00000000), ref: 00FCD4A1

Strings

\*.*, xrefs: 00FCD3F2

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 0cbbbe90c23b21cd797dc6dd68dc234bc3e4f446c456fad6ada7a6664c9e9d1a
Instruction ID: f43e8640a70ee5098c6b3672df78c0562a97261dd7924a05c2e568106c810afe
Opcode Fuzzy Hash: 0cbbbe90c23b21cd797dc6dd68dc234bc3e4f446c456fad6ada7a6664c9e9d1a
Instruction Fuzzy Hash: EF3180714083459BC304EF64DD929AFB7ACAE91314F444A2DF4D593191EB34AA09EBA3

Function 00F9E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F9E645

Strings

1#INF, xrefs: 00F9F852
1#IND, xrefs: 00F9F83D
1#SNAN, xrefs: 00F9F844
1#QNAN, xrefs: 00F9F84B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 61f98608cb48b98b830ce48c806e0f8e2c21333ffc9965f224a832d9d9f12502
Instruction ID: 54e9b6fe92723071253f070aff98f2eb282b39b7971645636592e64d6c743d72
Opcode Fuzzy Hash: 61f98608cb48b98b830ce48c806e0f8e2c21333ffc9965f224a832d9d9f12502
Instruction Fuzzy Hash: 57C25A72E086288FEF25CE28DD407EAB7B5EB84314F1441EAD44DE7240E779AE859F40

Function 00FD648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FD64DC
CoInitialize.OLE32(00000000), ref: 00FD6639
CoCreateInstance.OLE32(00FFFCF8,00000000,00000001,00FFFB68,?), ref: 00FD6650
CoUninitialize.OLE32 ref: 00FD68D4

Strings

.lnk, xrefs: 00FD64BA, 00FD6524, 00FD65E0

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 9bc7b017bfaaf20158c23f1ce62df3bc70565c758b3f3634e2f4e87b49604213
Instruction ID: 00a8b0ff880bd88c1e7c9b43d6823b64cfbc32cf99fe00db2a055ecc4515e78e
Opcode Fuzzy Hash: 9bc7b017bfaaf20158c23f1ce62df3bc70565c758b3f3634e2f4e87b49604213
Instruction Fuzzy Hash: ACD14771508301AFC304EF24C881A6BB7E9FF99704F04496DF595CB2A1EB71E949DBA2

Function 00FE22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00FE22E8

Part of subcall function 00FDE4EC: GetWindowRect.USER32(?,?), ref: 00FDE504

GetDesktopWindow.USER32 ref: 00FE2312
GetWindowRect.USER32(00000000), ref: 00FE2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00FE2355
GetCursorPos.USER32(?), ref: 00FE2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00FE23DF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 9b6e7b3e2ad492754567af8b764fd2a4d94144c8ca925360276d50887e8f31ac
Instruction ID: b25226978a889d52d81ccef19048d3862ca76335bdc58baef89db08e2e871494
Opcode Fuzzy Hash: 9b6e7b3e2ad492754567af8b764fd2a4d94144c8ca925360276d50887e8f31ac
Instruction Fuzzy Hash: B331BC72505359AFD720DF15C849B6BBBAEFF84710F040919F98597181EB34EA08DB92

Function 00FD9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00FD9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00FD9C8B

Part of subcall function 00FD3874: GetInputState.USER32 ref: 00FD38CB
Part of subcall function 00FD3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FD3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00FD9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00FD9C75

Strings

*.*, xrefs: 00FD9B5D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 103bb918e5cdb6b77b8e8b6b3c1d83ab500b6dfb36a746971ba9cd069a62dde9
Instruction ID: 388cda84588f11ef3f2c14674444060d490d95bf2c052a3c018736669e970740
Opcode Fuzzy Hash: 103bb918e5cdb6b77b8e8b6b3c1d83ab500b6dfb36a746971ba9cd069a62dde9
Instruction Fuzzy Hash: 05417071D0421A9FCF15DFA4CD45AEEBBB9EF05310F144056E815A32A1DB709E44EF60

Function 00FCAA57 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00FCAAAC
SetKeyboardState.USER32(00000080), ref: 00FCAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00FCAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00FCAB88

Strings

nitializeCriticalSectionEx, xrefs: 00FCAAEA

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID: nitializeCriticalSectionEx
API String ID: 432972143-216347044
Opcode ID: bb7a5506df042907b02370f82d4df0d8e447ebc524b7773d1b63da848545660e
Instruction ID: 22d72f56f4e46af6aa5d9a7120f0174c0e0e7f08f9e27756bd0603c0c93f62f0
Opcode Fuzzy Hash: bb7a5506df042907b02370f82d4df0d8e447ebc524b7773d1b63da848545660e
Instruction Fuzzy Hash: 04312930E4060DAEEB218A64CE06FFA77A6AFC4324F04421EF185561D1C775AD84E762

Function 00F68060 Relevance: 8.7, Strings: 6, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00F683FA
InitializeCriticalSectionEx, xrefs: 00FA5D0F
ERCP, xrefs: 00F6813C
VUUU, xrefs: 00F683E8
VUUU, xrefs: 00F6843C
VUUU, xrefs: 00FA5DF0

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: ERCP$InitializeCriticalSectionEx$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1173862840
Opcode ID: 1e9826bcb2315c1a8d89ba1366506bb7c8a1003dcfac736a5e461ff4c65a98be
Instruction ID: bc8679fefe409e74034b184555cb3c61c51f95e15db2731c696b0dd8ded3994a
Opcode Fuzzy Hash: 1e9826bcb2315c1a8d89ba1366506bb7c8a1003dcfac736a5e461ff4c65a98be
Instruction Fuzzy Hash: 32A2A4B1E0021ACBDF24CF58C8407ADB7B1BF55760F28829AD815A7385DB759D82EF50

Function 00F7997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00F79A4E
GetSysColor.USER32(0000000F), ref: 00F79B23
SetBkColor.GDI32(?,00000000), ref: 00F79B36

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 2786bc4c6ed8fcd17303d1fc7caf5f0abe1273f2e20f28e060cce377f1b94516
Instruction ID: 694059ad4d0489417103c5fb9fe90d53b69ee1a0455037d39c56a2bf37236739
Opcode Fuzzy Hash: 2786bc4c6ed8fcd17303d1fc7caf5f0abe1273f2e20f28e060cce377f1b94516
Instruction Fuzzy Hash: 23A1267150D508AEF724AA3E8C48FBB369DDBC6320B24811BF506C6695CAAD9D01F773

Function 00FE1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FE307A
Part of subcall function 00FE304E: _wcslen.LIBCMT ref: 00FE309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00FE185D
WSAGetLastError.WSOCK32 ref: 00FE1884
bind.WSOCK32(00000000,?,00000010), ref: 00FE18DB
WSAGetLastError.WSOCK32 ref: 00FE18E6
closesocket.WSOCK32(00000000), ref: 00FE1915

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: ef7ccc66cc340c66c05aba22b8b5263bcbf846c1866dafa4ef5a5cb88ef3c7dd
Instruction ID: 32b327b5c84b67804a09738b99060f26c1603dabf2291a97d90f18b73f40d860
Opcode Fuzzy Hash: ef7ccc66cc340c66c05aba22b8b5263bcbf846c1866dafa4ef5a5cb88ef3c7dd
Instruction Fuzzy Hash: 1B519171A00214AFDB10EF25C886F6A77E5AF44718F088099F94A9F393CB75AD41DBE1

Function 00FF1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00FF1CC0
IsWindowEnabled.USER32 ref: 00FF1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00FF1CDB
IsIconic.USER32 ref: 00FF1CE9
IsZoomed.USER32 ref: 00FF1CF7

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 845bcd72df7abb8622fce4c2842d249be57a65e7dd060ce30dd27d03da931bd5
Instruction ID: fd1ad02f98d67957264513d7327f6eb2cf3ced06ad2af8f07ca96363cfaa33dc
Opcode Fuzzy Hash: 845bcd72df7abb8622fce4c2842d249be57a65e7dd060ce30dd27d03da931bd5
Instruction Fuzzy Hash: ED21A631B40219DFD7208F1AC884B7A7BA9FF95324B198058E945CB361D775DC42EBD0

Function 00FEA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00FEA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00FEA6BA

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Process32NextW.KERNEL32(00000000,?), ref: 00FEA79C
CloseHandle.KERNEL32(00000000), ref: 00FEA7AB

Part of subcall function 00F7CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00FA3303,?), ref: 00F7CE8A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 8949cb18d5d0a8ed6641fb79e534d0f9e30c7258e12e7b1f5a550c05b1cbeeb4
Instruction ID: 7624c66799a6ff4ec743fd4ef6f40fcf192606876a6ecbc0b8c00325f0bac515
Opcode Fuzzy Hash: 8949cb18d5d0a8ed6641fb79e534d0f9e30c7258e12e7b1f5a550c05b1cbeeb4
Instruction Fuzzy Hash: A3515971508310AFD310EF24CC86A6BBBE8FF89754F00891DF58997291EB34E904EB92

Function 00F9BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F9BB7F

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

GetTimeZoneInformation.KERNEL32 ref: 00F9BB91
WideCharToMultiByte.KERNEL32(00000000,?,0103121C,000000FF,?,0000003F,?,?), ref: 00F9BC09
WideCharToMultiByte.KERNEL32(00000000,?,01031270,000000FF,?,0000003F,?,?,?,0103121C,000000FF,?,0000003F,?,?), ref: 00F9BC36

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 80f69ef35766f891ee338d0b3d3a1ad5d473ac4c1bfa9565f4cee95d4aedd75c
Instruction ID: d0fd62df407be11a891057d0e61ea8d60b88c45b2dffe89b9c9f613f5553c043
Opcode Fuzzy Hash: 80f69ef35766f891ee338d0b3d3a1ad5d473ac4c1bfa9565f4cee95d4aedd75c
Instruction Fuzzy Hash: E431C3B1904205EFDF21DF69ED80929BBB8FF8932071442AAE050D72A5D7359D10EB90

Function 00FDCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00FDCE89
GetLastError.KERNEL32(?,00000000), ref: 00FDCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00FDCEFE

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 953089b5864ec640eb2b154a46124f370a42b0d1ba1e90d9ca935cadd2c15fd0
Instruction ID: ea203e481ae9e6bee2a968960e930a412ec7aebb09aa45f520c39b4892f9cf8f
Opcode Fuzzy Hash: 953089b5864ec640eb2b154a46124f370a42b0d1ba1e90d9ca935cadd2c15fd0
Instruction Fuzzy Hash: CE2190B190030A9BD720DFA5C945BA777FDEF40364F14441EE546D2251E774ED04EBA0

Function 00FC8298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00FC82AA

Strings

(, xrefs: 00FC82F0
|, xrefs: 00FC82DA

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: f44b86f98b0886f90a337f90690d97f4ae18284f7cdc049378a19977433f8a7f
Instruction ID: 8ef4cca9734889573b7e25935249203c032b8c6469aed0367deae7e604aba6e7
Opcode Fuzzy Hash: f44b86f98b0886f90a337f90690d97f4ae18284f7cdc049378a19977433f8a7f
Instruction Fuzzy Hash: F4324775A006069FC728CF59C581E6AB7F0FF48760B15C46EE49ADB3A1EB70E942DB40

Function 00FD5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FD5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00FD5D17
FindClose.KERNEL32(?), ref: 00FD5D5F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: b2d710743ca7f4ba4252fc8244e4cfe1a956c03f2925f4e9ed07cb10f1290697
Instruction ID: 015683a526795e7f78ef34b17de4ba061dc7b8c21d28de01b4326e8952374276
Opcode Fuzzy Hash: b2d710743ca7f4ba4252fc8244e4cfe1a956c03f2925f4e9ed07cb10f1290697
Instruction Fuzzy Hash: F6519C35A046019FC714DF28C894E96B7E5FF49324F18855EE99A8B3A1CB30ED04DFA1

Function 00F92622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00F9271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F92724
UnhandledExceptionFilter.KERNEL32(?), ref: 00F92731

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 12037fcf6885de4e0ebdc4174195ef9922920c3757d29d6e6cbc580833cf7188
Instruction ID: 7f414f3c9521f283b7bf045c61d45f8ebe906922face7a831f533d574bb45591
Opcode Fuzzy Hash: 12037fcf6885de4e0ebdc4174195ef9922920c3757d29d6e6cbc580833cf7188
Instruction Fuzzy Hash: 4931D67490122CABCB61DF64DD887DCB7B8AF08710F5041EAE41CA7260EB349F859F45

Function 00FD51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FD51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00FD5238
SetErrorMode.KERNEL32(00000000), ref: 00FD52A1

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: f5f1439115eb023ba4fe1eb5e20d599ae3211c8e9b050719ce48f9269dc1a0de
Instruction ID: f70d375b2df757520ee47857de08ac57492873a09372fdb6123469bde82d6d33
Opcode Fuzzy Hash: f5f1439115eb023ba4fe1eb5e20d599ae3211c8e9b050719ce48f9269dc1a0de
Instruction Fuzzy Hash: 7C318035A00518DFDB00DF54D884EADBBB5FF08314F088099E8459B352C735E859DB90

Function 00FC16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00F7FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00F80668
Part of subcall function 00F7FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00F80685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FC170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FC173A
GetLastError.KERNEL32 ref: 00FC174A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 0fb4771d4f720df03cf221934cbeabb24a5761f175579c6c0733426b22823141
Instruction ID: 4283b2bdd56b7c3442596f1d360357f611d71e2066b4fc642e7600f4b88ce15c
Opcode Fuzzy Hash: 0fb4771d4f720df03cf221934cbeabb24a5761f175579c6c0733426b22823141
Instruction Fuzzy Hash: 5711C1B2400309FFD7289F54DD86E6AB7BDFF44714B20852EE05693241EB70BC41DA60

Function 00FCD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00FCD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00FCD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00FCD650

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: db96e0b20be6f5c028c4614ff1130cd9efccacd32440c2ea8352ae9132155a0e
Instruction ID: 33b8a3b9d27a5535506121df61e07d7c94af94a86d8787a154731f9502c63dc6
Opcode Fuzzy Hash: db96e0b20be6f5c028c4614ff1130cd9efccacd32440c2ea8352ae9132155a0e
Instruction Fuzzy Hash: E9113C75E05228BBDB108F999D45FAFBBBCEB45B60F108126F904E7290D6704A05EBA1

Function 00FC1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00FC168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00FC16A1
FreeSid.ADVAPI32(?), ref: 00FC16B1

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 01db644cb15c7aa052031f30bc3f23e01c7c2db08de5d1657101f01d47c01bf3
Instruction ID: 97de250f2ef66d78b2238bd931c68b5f08646b55d297a9044ace1c8994eca444
Opcode Fuzzy Hash: 01db644cb15c7aa052031f30bc3f23e01c7c2db08de5d1657101f01d47c01bf3
Instruction Fuzzy Hash: 38F0F47195030DFBDB00DFE49D89EAEBBBCFF08604F504965E501E2181E774AA44AA94

Function 00F84CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00F928E9,?,00F84CBE,00F928E9,010288B8,0000000C,00F84E15,00F928E9,00000002,00000000,?,00F928E9), ref: 00F84D09
TerminateProcess.KERNEL32(00000000,?,00F84CBE,00F928E9,010288B8,0000000C,00F84E15,00F928E9,00000002,00000000,?,00F928E9), ref: 00F84D10
ExitProcess.KERNEL32 ref: 00F84D22

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 532320517b497699d361591d9dee33ab5ef28e690f019caea1e5b197bf2d2703
Instruction ID: 88dece2c421913057046aa58cdb7821defaf7c1750cdeaaf48cbab857de60322
Opcode Fuzzy Hash: 532320517b497699d361591d9dee33ab5ef28e690f019caea1e5b197bf2d2703
Instruction Fuzzy Hash: 3AE0B63240015DABDF12BF54DE09EA87B6DEF41791B104014FC058A122CB39ED52EF80

Function 00FBD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00FBD28C

Strings

X64, xrefs: 00FBD2A8

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 84ae253663d53748348ee38867d9012509c00683cbd05a5e035fc29a81b5ae21
Instruction ID: 779aa8130ce36e9e075fbfce9f9e81d5215e4b0ff17b5ec5539b178b04e28df0
Opcode Fuzzy Hash: 84ae253663d53748348ee38867d9012509c00683cbd05a5e035fc29a81b5ae21
Instruction Fuzzy Hash: E8D0C9B580112DEACB94CB90DC88ED9B37CBF04305F104156F106E2000DB309549AF10

Function 00F8CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 59cf0cfe376c6b22ac24ada35262cc7a2cf2d019801a8691e9a69f7ef42f306f
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: A4021D72E001199BDF14DFA9C8806EDBBF1FF48324F25816AD919E7380D731A9419B94

Function 00FD68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FD6918
FindClose.KERNEL32(00000000), ref: 00FD6961

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: e749b969a66492cda84b21373cd4779c3d0dffa4e0d9b744552d891529558a05
Instruction ID: 3d11a4395e5a50aebacb66b2d99e2b57fe285f7eb30e27e56b312be38e79d338
Opcode Fuzzy Hash: e749b969a66492cda84b21373cd4779c3d0dffa4e0d9b744552d891529558a05
Instruction Fuzzy Hash: E91193316042149FC710DF69D884A26BBE5FF85328F19C69AE4698F3A2C734EC05DBD1

Function 00FD37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00FE4891,?,?,00000035,?), ref: 00FD37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00FE4891,?,?,00000035,?), ref: 00FD37F4

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: c71b9d13e7cb966f3d9706d546f5b6a360be2bb17f3c23e8326cd0f0b9410d87
Instruction ID: 6c81f487a2d140f92fd67e3d68d6723cad95aba7b20556974fa006e6c7abb846
Opcode Fuzzy Hash: c71b9d13e7cb966f3d9706d546f5b6a360be2bb17f3c23e8326cd0f0b9410d87
Instruction Fuzzy Hash: 1EF0E5B160922D2AE72017668C4DFEB3AAEEFC5771F000166F609E2281D9609904D6F1

Function 00FCB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00FCB25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00FCB270

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 41062b50c8b6c4ed0e10b41c1f5ec74f9527c9947d5bd7a1e9ac4fae39917359
Instruction ID: 1f0462067e3617d969c167cc8c80a4fd49fc12e0f7249c422367f6f05b82f212
Opcode Fuzzy Hash: 41062b50c8b6c4ed0e10b41c1f5ec74f9527c9947d5bd7a1e9ac4fae39917359
Instruction Fuzzy Hash: D0F06D7580424EABDB059FA0C806BFE7BB4FF04305F048009F951A5191C3798601EF94

Function 00FC10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FC11FC), ref: 00FC10D4
CloseHandle.KERNEL32(?,?,00FC11FC), ref: 00FC10E9

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: e5a6c0e16028de7f798aaadbc66081f470b3df31c0a09d355448cab0e33c4f77
Instruction ID: 9df4887cd2f1475bc92ab325de9610c418c8b7d033fd8cb3feac9f562b3ff2d4
Opcode Fuzzy Hash: e5a6c0e16028de7f798aaadbc66081f470b3df31c0a09d355448cab0e33c4f77
Instruction Fuzzy Hash: A6E04F32008614AEF7252B11FD05E7377ADEF04320B10C82EF4A5804B1DB626CA1FB50

Function 00F6CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00FB0C40

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 46058abf21a6b8827244a04553b9a2efbd95d1bba592ca4a8b2d603ee22e0f88
Instruction ID: bf11a035de0fef91a9f9c8141fbd0f6d27445675a3b5713ef367b42057b010d5
Opcode Fuzzy Hash: 46058abf21a6b8827244a04553b9a2efbd95d1bba592ca4a8b2d603ee22e0f88
Instruction Fuzzy Hash: 83328C71D00218DBCF14DF90C981BFEB7B5BF08314F148059E896AB292DB79AD45EBA1

Function 00F9676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F96766,?,?,00000008,?,?,00F9FEFE,00000000), ref: 00F96998

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 535137d1096c7a119da351139557dbd8d6fa6b99c5a32324cd252b21de3e39d9
Instruction ID: a18312f51070c564b81577785d69e5c010884cd2a9c91808766313e8bee96400
Opcode Fuzzy Hash: 535137d1096c7a119da351139557dbd8d6fa6b99c5a32324cd252b21de3e39d9
Instruction Fuzzy Hash: BBB13E32910609DFEB15CF28C48AB657BE0FF45364F25C658E899CF2A2C739D991DB40

Function 00F7B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00FB851F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 60be78a0fee9dde7b5108117293f396245b55d7b0b4f54458eb0a373c1ac43f8
Instruction ID: eafe7cdf54fe4b7e5bab424a67617d1c1b52e32f2205157b556b22a2fd10e1f1
Opcode Fuzzy Hash: 60be78a0fee9dde7b5108117293f396245b55d7b0b4f54458eb0a373c1ac43f8
Instruction Fuzzy Hash: A7125D71D002299BCB24CF59C880BEEB7F5FF49710F14819AE849EB255DB349A81EF91

Function 00FDEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00FDEABD

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 888fe48283c5c3db131149d32d720f75d35c0ba5bf91c1bd0ff8fbd094059b6d
Instruction ID: ea2e980203d18ac7982d15738c4ce5b0a316b308f3990d40a576b73528281e16
Opcode Fuzzy Hash: 888fe48283c5c3db131149d32d720f75d35c0ba5bf91c1bd0ff8fbd094059b6d
Instruction Fuzzy Hash: A1E01A322002159FC710EF59D804E9AB7E9AF98760F048416FC4ACB361DAB4A840ABA0

Function 00F809D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00F803EE), ref: 00F809DA

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 048fa64dc50fb6371860f331262c8970c37075a9b66058558c5e69be0513b26f
Instruction ID: 06ad0dd35eeafc18c3e2e7736d1cd97413ce1ba2976a265784744eba6f264f75
Opcode Fuzzy Hash: 048fa64dc50fb6371860f331262c8970c37075a9b66058558c5e69be0513b26f
Instruction Fuzzy Hash:

Function 00F8781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00F8798B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: ae75fd5434068fe33e599ad357eb09fecd0c0c9deb8e430edf0d7767a0ad902e
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 62519972E0C7055BDB38B528889E7FF77899B023A0F380509E886C7282D719DE06F352

Function 00F96DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c51a8e1d334db54d71bbd70d3e38607c95101b678f458e1f651a8a0fa6b75af
Instruction ID: 1a7f59360471a33ec500cf6a614a596b45e41fa360d4a615f900f11b19d6ee67
Opcode Fuzzy Hash: 4c51a8e1d334db54d71bbd70d3e38607c95101b678f458e1f651a8a0fa6b75af
Instruction Fuzzy Hash: E6324632D39F414DEB63A634C8263356249AFB73D5F15C737F81AB599AEB2AC4835200

Function 00F7CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee65230762834361528d5e7e25f24e288b00eff4c6e45c872960a7505dcfd85
Instruction ID: cad89ceb39342d0e20c0c3b944cdc6a74d83967e827b0fc9c8702b4fc2716264
Opcode Fuzzy Hash: 0ee65230762834361528d5e7e25f24e288b00eff4c6e45c872960a7505dcfd85
Instruction Fuzzy Hash: 3632E332E001958BDF35CE2AC4A46FE7BA1EB45320F28856BD5998B291D634DD81FFC1

Function 00F67920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1792cd155826e2b7a48748b0dbbfe27e0f236bfb623405e069a8f68226234b7d
Instruction ID: 7e847db72f2912f86692d954fd35a3c5da9595f27f54816835b64ce4a32c5e24
Opcode Fuzzy Hash: 1792cd155826e2b7a48748b0dbbfe27e0f236bfb623405e069a8f68226234b7d
Instruction Fuzzy Hash: 2122D1B0E04609DFDF14DFA4C841BAEB3F6FF45714F244129E816A7291EB3AA914EB50

Function 00F691C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d8c1fcb5202845211ab6cf60f8a18a78f207cca27d7c1d8faf24b610a4a443
Instruction ID: 965d35fb58c68be6e658e2aac60406cb45b3941478e04924fb900b038844b846
Opcode Fuzzy Hash: b0d8c1fcb5202845211ab6cf60f8a18a78f207cca27d7c1d8faf24b610a4a443
Instruction Fuzzy Hash: 4202C6B1E00106EBDB14DF54D881BAEB7B5FF45310F208169E806DB391EB75AE14EB91

Function 00F99EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da0a462113efbc617a6adf9c6c424cfe04c613877f035e03ccf9b63b1530dbe
Instruction ID: d7c010538de4db5c745a251b7d1c9ce7aea82f4a5668b20ef79310e743bf14ee
Opcode Fuzzy Hash: 6da0a462113efbc617a6adf9c6c424cfe04c613877f035e03ccf9b63b1530dbe
Instruction Fuzzy Hash: 6BB1EF30D2AF404DD62396398861336B74CBFBB2D5F92D31BFC6678E16EB2685834240

Function 00F81C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 9ca210a0bd3204a7a6aeb688ad4b88e715563320d36ea49f184430851c52fe57
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: C6918773A080A34ADB29563A85351BEFFE57A923B131A079DD4F2CA1C1FE10D956F720

Function 00F81F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: f52951f963e5b3a8005ba46bbd1aa8e1c3de21ddbca63bdd559a11cba76b753e
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 56917673A080A34ADB69523984790BEFFE15B923B131A079ED4F2CB1C5EE249555F720

Function 00F819B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: f93a3e0c08e066a6805a4ef06d8baeb0845f7b224b59d8619f3494e4ce359c16
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 1A9184736090A34ADB2D527A85740BEFFE96A923B131A079ED4F2CA1C1FD14C566F720

Function 00F87A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974c8a6147a2a91e97ee929db8208fd2d1471f403b30a91e27e7518489d8a8d4
Instruction ID: 8d09725947f06124d5ee7149e0ad56eb10fcd1a6fa1673ece9b2e0f613e293a3
Opcode Fuzzy Hash: 974c8a6147a2a91e97ee929db8208fd2d1471f403b30a91e27e7518489d8a8d4
Instruction Fuzzy Hash: 78618932A0C30956DE38B9288C96BFE7386DF81760F340919E843DB295DA19DE43B315

Function 00F87CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b1d3f94fa1b29ab66d89aa7cda61e0b9b1fa0a3fe9dc1bb0658838ee9b8c33
Instruction ID: b8c7887957066f3ce1c6e20b9db1831f866d1c6235dc5fa4d9648ceafcb28cef
Opcode Fuzzy Hash: 40b1d3f94fa1b29ab66d89aa7cda61e0b9b1fa0a3fe9dc1bb0658838ee9b8c33
Instruction Fuzzy Hash: BC616933E0C70996DE38BA284C95BFF7384AF42764F341959E843DB281EA16ED42B355

Function 00F81706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 8caffb87d3bc8266412baf6d075664b35c176a9734b7ef6f3880cc7c6a44ac32
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 73817333A080A309EB6D563A85354BEFFE57A923B131A079DD4F2CA1C1EE248559F720

Function 00FB3CE7 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f766239e90814e5f5c62cf41b5969846b5707b6dd430a60c0b1b9d3ad6ae7854
Instruction ID: b9de026a6c7e4f1d99916cf2725cadaaf90625e7879dc6f09e28ae17553164bf
Opcode Fuzzy Hash: f766239e90814e5f5c62cf41b5969846b5707b6dd430a60c0b1b9d3ad6ae7854
Instruction Fuzzy Hash: 31512776A09285DFC726CF2584E46D5BFE1EF52320B1E84AFCCC647252C635A94AEB01

Function 00FD2046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5775b2def44fd118b413c5199338ae69877c01431852abae37da2a7993ffa011
Instruction ID: 6b151a5f70177c75b4ced6c8fa75469a89cfd2feb1adfd2acbf0c18e638055bf
Opcode Fuzzy Hash: 5775b2def44fd118b413c5199338ae69877c01431852abae37da2a7993ffa011
Instruction Fuzzy Hash: 7A21DD327215118BD728CE79C91367E73D9A764320F19862EE4E7C37C4DE3AA904D780

Function 00FE2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FE2B30
DeleteObject.GDI32(00000000), ref: 00FE2B43
DestroyWindow.USER32 ref: 00FE2B52
GetDesktopWindow.USER32 ref: 00FE2B6D
GetWindowRect.USER32(00000000), ref: 00FE2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00FE2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00FE2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2CF8
GetClientRect.USER32(00000000,?), ref: 00FE2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00FE2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2DA8
GlobalFree.KERNEL32(00000000), ref: 00FE2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00FFFC38,00000000), ref: 00FE2DDB
GlobalFree.KERNEL32(00000000), ref: 00FE2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00FE2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00FE2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE303F

Strings

AutoIt v3, xrefs: 00FE2CF2
static, xrefs: 00FE2D3A, 00FE2E91
, xrefs: 00FE2FC5
DISPLAY, xrefs: 00FE2EA2

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: d55dc49baddb80d466ba5e4f027048b600dafcdec6783ea8f6844b157f46f034
Instruction ID: 2f4d83fb5d4fcf629f358f3c08d96acdf7cb1ff3741193d1c097ba257b3d51cf
Opcode Fuzzy Hash: d55dc49baddb80d466ba5e4f027048b600dafcdec6783ea8f6844b157f46f034
Instruction Fuzzy Hash: B1028E71900219AFDB14DF64CD89EAE7BBDFF48310F048158F915AB2A1DB74AD01EBA0

Function 00FF70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00FF712F
GetSysColorBrush.USER32(0000000F), ref: 00FF7160
GetSysColor.USER32(0000000F), ref: 00FF716C
SetBkColor.GDI32(?,000000FF), ref: 00FF7186
SelectObject.GDI32(?,?), ref: 00FF7195
InflateRect.USER32(?,000000FF,000000FF), ref: 00FF71C0
GetSysColor.USER32(00000010), ref: 00FF71C8
CreateSolidBrush.GDI32(00000000), ref: 00FF71CF
FrameRect.USER32(?,?,00000000), ref: 00FF71DE
DeleteObject.GDI32(00000000), ref: 00FF71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00FF7230
FillRect.USER32(?,?,?), ref: 00FF7262
GetWindowLongW.USER32(?,000000F0), ref: 00FF7284

Part of subcall function 00FF73E8: GetSysColor.USER32(00000012), ref: 00FF7421
Part of subcall function 00FF73E8: SetTextColor.GDI32(?,?), ref: 00FF7425
Part of subcall function 00FF73E8: GetSysColorBrush.USER32(0000000F), ref: 00FF743B
Part of subcall function 00FF73E8: GetSysColor.USER32(0000000F), ref: 00FF7446
Part of subcall function 00FF73E8: GetSysColor.USER32(00000011), ref: 00FF7463
Part of subcall function 00FF73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FF7471
Part of subcall function 00FF73E8: SelectObject.GDI32(?,00000000), ref: 00FF7482
Part of subcall function 00FF73E8: SetBkColor.GDI32(?,00000000), ref: 00FF748B
Part of subcall function 00FF73E8: SelectObject.GDI32(?,?), ref: 00FF7498
Part of subcall function 00FF73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00FF74B7
Part of subcall function 00FF73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FF74CE
Part of subcall function 00FF73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00FF74DB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 1248b3d06390e7c957724111df049ad54f969e8cb451e9ceaaeda68b44fde68f
Instruction ID: 3b4c2be501244046c5992f10752b579b9ab3c887787e758c5873c54f7bf9d7b3
Opcode Fuzzy Hash: 1248b3d06390e7c957724111df049ad54f969e8cb451e9ceaaeda68b44fde68f
Instruction Fuzzy Hash: D5A19172408319AFD700AF60DD48E7BBBA9FF49320F140A19FA62961E1D771E944EB91

Function 00F78D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00F78E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00FB6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00FB6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00FB6F43

Part of subcall function 00F78F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F78BE8,?,00000000,?,?,?,?,00F78BBA,00000000,?), ref: 00F78FC5

SendMessageW.USER32(?,00001053), ref: 00FB6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00FB6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00FB6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00FB6FB7

Strings

0, xrefs: 00FB6DCF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 5dc8c3c475ee0b9de80de7d0669eb60bf671a029947d0f117f186937090b3910
Instruction ID: 7ab029d1c831f25f5dac99e1827e28d0b1a18cff98d6ae5ffebaf9b53bc22feb
Opcode Fuzzy Hash: 5dc8c3c475ee0b9de80de7d0669eb60bf671a029947d0f117f186937090b3910
Instruction Fuzzy Hash: 1212CE35A00215EFC725CF15D948BB5BBA5FF48320F18846AF499CB251CB3AE852EF91

Function 00FE2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00FE273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00FE286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00FE28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00FE28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00FE2900
GetClientRect.USER32(00000000,?), ref: 00FE290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00FE2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00FE2964
GetStockObject.GDI32(00000011), ref: 00FE2974
SelectObject.GDI32(00000000,00000000), ref: 00FE2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00FE2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FE2991
DeleteDC.GDI32(00000000), ref: 00FE299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00FE29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00FE29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00FE2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00FE2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00FE2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00FE2A77
GetStockObject.GDI32(00000011), ref: 00FE2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00FE2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00FE2A97

Strings

AutoIt v3, xrefs: 00FE28F8
static, xrefs: 00FE294F, 00FE2A71
msctls_progress32, xrefs: 00FE2A13
DISPLAY, xrefs: 00FE295A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 887f2b8718b3def47fbc76438e13613fd3747aefb27b5956ce2f9badea55bb3c
Instruction ID: 076aeb9a816b8d116b1d426913b81de1fcf1b0f0e2494af1a437fd14d07a5d19
Opcode Fuzzy Hash: 887f2b8718b3def47fbc76438e13613fd3747aefb27b5956ce2f9badea55bb3c
Instruction Fuzzy Hash: DAB13BB1A00219AFEB14DF69CD89EAA7BADEF08710F008155FA15E7290D774AD40DBA0

Function 00FD4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FD4AED
GetDriveTypeW.KERNEL32(?,00FFCB68,?,\\.\,00FFCC08), ref: 00FD4BCA
SetErrorMode.KERNEL32(00000000,00FFCB68,?,\\.\,00FFCC08), ref: 00FD4D36

Strings

MMC, xrefs: 00FD4CDE
Removable, xrefs: 00FD4C10, 00FD4C15
ATA, xrefs: 00FD4C98
SSA, xrefs: 00FD4CA6
Fixed, xrefs: 00FD4C09
USB, xrefs: 00FD4CB4
CDROM, xrefs: 00FD4BFB
FileBackedVirtual, xrefs: 00FD4CEC
\\.\, xrefs: 00FD4B3F
ATAPI, xrefs: 00FD4C91
SSD, xrefs: 00FD4C4A
Virtual, xrefs: 00FD4CE5
PhysicalDrive, xrefs: 00FD4B76
Unknown, xrefs: 00FD4BED, 00FD4C83
Network, xrefs: 00FD4C02
SCSI, xrefs: 00FD4C8A
1394, xrefs: 00FD4C9F
SATA, xrefs: 00FD4CD0
iSCSI, xrefs: 00FD4CC2
SAS, xrefs: 00FD4CC9
RAMDisk, xrefs: 00FD4BF4
Fibre, xrefs: 00FD4CAD
RAID, xrefs: 00FD4CBB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 2d826aad772f38eb77d6d3b974cb6c50de729838d0b90a76a1b694dc06f646bb
Instruction ID: 2cbcf5d40014f0f9a35407ca6646d15f24b1f00b36d6ea8bad057e7df0539c21
Opcode Fuzzy Hash: 2d826aad772f38eb77d6d3b974cb6c50de729838d0b90a76a1b694dc06f646bb
Instruction Fuzzy Hash: 8E61A531A1610ADBCB04EF24CA82A7C77B2AB44314B28455BF846AB751DB76FD81FB41

Function 00FF73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00FF7421
SetTextColor.GDI32(?,?), ref: 00FF7425
GetSysColorBrush.USER32(0000000F), ref: 00FF743B
GetSysColor.USER32(0000000F), ref: 00FF7446
CreateSolidBrush.GDI32(?), ref: 00FF744B
GetSysColor.USER32(00000011), ref: 00FF7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FF7471
SelectObject.GDI32(?,00000000), ref: 00FF7482
SetBkColor.GDI32(?,00000000), ref: 00FF748B
SelectObject.GDI32(?,?), ref: 00FF7498
InflateRect.USER32(?,000000FF,000000FF), ref: 00FF74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FF74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00FF74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FF752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00FF7554
InflateRect.USER32(?,000000FD,000000FD), ref: 00FF7572
DrawFocusRect.USER32(?,?), ref: 00FF757D
GetSysColor.USER32(00000011), ref: 00FF758E
SetTextColor.GDI32(?,00000000), ref: 00FF7596
DrawTextW.USER32(?,00FF70F5,000000FF,?,00000000), ref: 00FF75A8
SelectObject.GDI32(?,?), ref: 00FF75BF
DeleteObject.GDI32(?), ref: 00FF75CA
SelectObject.GDI32(?,?), ref: 00FF75D0
DeleteObject.GDI32(?), ref: 00FF75D5
SetTextColor.GDI32(?,?), ref: 00FF75DB
SetBkColor.GDI32(?,?), ref: 00FF75E5

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 413ff97cb6405f120a685e17c38620d867c506fa9acfe628370fd002d39b6f15
Instruction ID: 62e3db3f262e05be8ce7099d78c93b833e102eb22dbb1eaf33d47ba8ebf349f7
Opcode Fuzzy Hash: 413ff97cb6405f120a685e17c38620d867c506fa9acfe628370fd002d39b6f15
Instruction Fuzzy Hash: 41616F72D0421CAFDB019FA4DD49EEEBF79EF08320F144115FA15AB2A1D7B49940EB90

Function 00FF0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00FF1128
GetDesktopWindow.USER32 ref: 00FF113D
GetWindowRect.USER32(00000000), ref: 00FF1144
GetWindowLongW.USER32(?,000000F0), ref: 00FF1199
DestroyWindow.USER32(?), ref: 00FF11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00FF11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FF120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00FF121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00FF1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00FF1245
IsWindowVisible.USER32(00000000), ref: 00FF12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00FF12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00FF12D0
GetWindowRect.USER32(00000000,?), ref: 00FF12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00FF130E
GetMonitorInfoW.USER32(00000000,?), ref: 00FF1328
CopyRect.USER32(?,?), ref: 00FF133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00FF13AA

Strings

0, xrefs: 00FF10D3
(, xrefs: 00FF131B
tooltips_class32, xrefs: 00FF11E6

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: c06bf1955013da96cd911993a9a3d99157e6b160fe3301934c7b18ccd407d5e9
Instruction ID: 519b1562612e790e6330910fe31b8f67cd496a9212f4ac7ff5200838cda0182f
Opcode Fuzzy Hash: c06bf1955013da96cd911993a9a3d99157e6b160fe3301934c7b18ccd407d5e9
Instruction Fuzzy Hash: 0FB18B71608355EFD700DF64C984BAABBE8FF84750F008918FA999B261DB71EC44EB91

Function 00F78891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F78968
GetSystemMetrics.USER32(00000007), ref: 00F78970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F7899B
GetSystemMetrics.USER32(00000008), ref: 00F789A3
GetSystemMetrics.USER32(00000004), ref: 00F789C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00F789E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00F789F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00F78A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00F78A3C
GetClientRect.USER32(00000000,000000FF), ref: 00F78A5A
GetStockObject.GDI32(00000011), ref: 00F78A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F78A81

Part of subcall function 00F7912D: GetCursorPos.USER32(?), ref: 00F79141
Part of subcall function 00F7912D: ScreenToClient.USER32(00000000,?), ref: 00F7915E
Part of subcall function 00F7912D: GetAsyncKeyState.USER32(00000001), ref: 00F79183
Part of subcall function 00F7912D: GetAsyncKeyState.USER32(00000002), ref: 00F7919D

SetTimer.USER32(00000000,00000000,00000028,00F790FC), ref: 00F78AA8

Strings

AutoIt v3 GUI, xrefs: 00F78A20

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 4d7aa19e4b2f9759f8d5174e686f9afe93e4366033a9e3b0765da18688a9a942
Instruction ID: 170f19a343250bf455a2b5becfc2eaad3dc9afeaeb09230eb5d47e2b4a076116
Opcode Fuzzy Hash: 4d7aa19e4b2f9759f8d5174e686f9afe93e4366033a9e3b0765da18688a9a942
Instruction Fuzzy Hash: A7B16E71A00209AFDB14DF68C949BEA3BB9FB48314F14412AFA19E7290DB78D841DF51

Function 00FC0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FC1114
Part of subcall function 00FC10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1120
Part of subcall function 00FC10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC112F
Part of subcall function 00FC10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1136
Part of subcall function 00FC10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FC114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FC0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FC0E29
GetLengthSid.ADVAPI32(?), ref: 00FC0E40
GetAce.ADVAPI32(?,00000000,?), ref: 00FC0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FC0E96
GetLengthSid.ADVAPI32(?), ref: 00FC0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00FC0EB5
HeapAlloc.KERNEL32(00000000), ref: 00FC0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FC0EDD
CopySid.ADVAPI32(00000000), ref: 00FC0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FC0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FC0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FC0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0F6E
HeapFree.KERNEL32(00000000), ref: 00FC0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0F7E
HeapFree.KERNEL32(00000000), ref: 00FC0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0F8E
HeapFree.KERNEL32(00000000), ref: 00FC0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00FC0FA1
HeapFree.KERNEL32(00000000), ref: 00FC0FA8

Part of subcall function 00FC1193: GetProcessHeap.KERNEL32(00000008,00FC0BB1,?,00000000,?,00FC0BB1,?), ref: 00FC11A1
Part of subcall function 00FC1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00FC0BB1,?), ref: 00FC11A8
Part of subcall function 00FC1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00FC0BB1,?), ref: 00FC11B7

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: bcba0098d6bdc4d95fa54bb53383102e8dd3c3bf2c46347e11b5b1dd0a20f3b5
Instruction ID: cd81884acc70289ef66de5d4a97e6ae6807779b74daa652276ccafeda3e196ce
Opcode Fuzzy Hash: bcba0098d6bdc4d95fa54bb53383102e8dd3c3bf2c46347e11b5b1dd0a20f3b5
Instruction Fuzzy Hash: EE716B72D0021AEBDF209FA5DE45FAEBBBCFF05310F044119E919E6191DB309A56DBA0

Function 00FEC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FEC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00FFCC08,00000000,?,00000000,?,?), ref: 00FEC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00FEC5A4
_wcslen.LIBCMT ref: 00FEC5F4
_wcslen.LIBCMT ref: 00FEC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00FEC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00FEC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00FEC84D
RegCloseKey.ADVAPI32(?), ref: 00FEC881
RegCloseKey.ADVAPI32(00000000), ref: 00FEC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00FEC960

Strings

REG_QWORD, xrefs: 00FEC8C3
REG_EXPAND_SZ, xrefs: 00FEC5CD
REG_BINARY, xrefs: 00FEC913
REG_SZ, xrefs: 00FEC644
REG_DWORD, xrefs: 00FEC804
REG_MULTI_SZ, xrefs: 00FEC6F5

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 29558f165d9e9c64b94698aa4d33714091b6fc3931b9bc168fe106f1da24ac8c
Instruction ID: 9c543f0c2c65d47d3fd5607623cac21ca1058ab9556c7299125505a7d2a515bb
Opcode Fuzzy Hash: 29558f165d9e9c64b94698aa4d33714091b6fc3931b9bc168fe106f1da24ac8c
Instruction Fuzzy Hash: BE127E356042419FD714DF15C881A2AB7E5FF88724F14889DF88A9B3A2DB35FD41EB81

Function 00FF091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FF09C6
_wcslen.LIBCMT ref: 00FF0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00FF0A54
_wcslen.LIBCMT ref: 00FF0A8A
_wcslen.LIBCMT ref: 00FF0B06
_wcslen.LIBCMT ref: 00FF0B81

Part of subcall function 00F7F9F2: _wcslen.LIBCMT ref: 00F7F9FD

Part of subcall function 00FC2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FC2BFA

Strings

CHECK, xrefs: 00FF0A85, 00FF0AA0
EXISTS, xrefs: 00FF0B7C, 00FF0B97
ISCHECKED, xrefs: 00FF0CE1
UNCHECK, xrefs: 00FF0D3E
GETTOTALCOUNT, xrefs: 00FF09F2, 00FF0A17
GETSELECTED, xrefs: 00FF0C4E
EXPAND, xrefs: 00FF0BF8
GETITEMCOUNT, xrefs: 00FF0C1E
GETTEXT, xrefs: 00FF0C97
COLLAPSE, xrefs: 00FF0B01, 00FF0B1C
SELECT, xrefs: 00FF0D11

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 2e0c43342174bf0dc6a42a673bbf2734e350a0461624b178225aca72458ac74a
Instruction ID: 8b0d22376ac93d231d9c50d7bc4731bc7e24df2c5bc98bd0a556ab50571040e2
Opcode Fuzzy Hash: 2e0c43342174bf0dc6a42a673bbf2734e350a0461624b178225aca72458ac74a
Instruction Fuzzy Hash: CEE1AE326083158FC714EF24C85093AB7E1FF98324B14899DF99A9B362DB35ED45EB81

Function 00FEC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FEB6AE,?,?), ref: 00FEC9B5
_wcslen.LIBCMT ref: 00FEC9F1
_wcslen.LIBCMT ref: 00FECA68
_wcslen.LIBCMT ref: 00FECA9E
_wcslen.LIBCMT ref: 00FECAF9
_wcslen.LIBCMT ref: 00FECB2F
_wcslen.LIBCMT ref: 00FECB7F

Strings

HKCR, xrefs: 00FECB29, 00FECB2E
HKEY_LOCAL_MACHINE, xrefs: 00FECA62, 00FECA67
HKCC, xrefs: 00FECBAC
HKCU, xrefs: 00FECBCE
HKEY_USERS, xrefs: 00FECBDF
HKU, xrefs: 00FECBF0
HKLM, xrefs: 00FECA98, 00FECA9D
HKEY_CLASSES_ROOT, xrefs: 00FECAF3, 00FECAF8
HKEY_CURRENT_USER, xrefs: 00FECBBD
HKEY_CURRENT_CONFIG, xrefs: 00FECB79, 00FECB7E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 455faad42becf0eb80ecadceaa6fac0c8612684d49c501d744536eb54bb25a18
Instruction ID: 506805815de5d12010b79106124f2a1be7c4742c8493422f1cfaff4a94d3e1b8
Opcode Fuzzy Hash: 455faad42becf0eb80ecadceaa6fac0c8612684d49c501d744536eb54bb25a18
Instruction Fuzzy Hash: FE710933A001EA8BCB20DE7ECD515BE33A5AFA0B74B210125F86597284E639CD46F3D0

Function 00FF833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FF835A
_wcslen.LIBCMT ref: 00FF836E
_wcslen.LIBCMT ref: 00FF8391
_wcslen.LIBCMT ref: 00FF83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00FF83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00FF361A,?), ref: 00FF844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FF8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00FF84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FF8501
FreeLibrary.KERNEL32(?), ref: 00FF850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FF851D
DestroyIcon.USER32(?), ref: 00FF852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00FF8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00FF8555

Strings

.exe, xrefs: 00FF8388
.dll, xrefs: 00FF83AB
.icl, xrefs: 00FF8368

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 4226456e47d25d223a9b66827ae3f60c89053b151d246afd8313353240048b23
Instruction ID: 37e54670b33c16b5ac56085a292f4ac08f8c6e65b6d0063abafaa487de47b809
Opcode Fuzzy Hash: 4226456e47d25d223a9b66827ae3f60c89053b151d246afd8313353240048b23
Instruction Fuzzy Hash: C761D07290021EBAEB14DF64CC81BFE77ACBF08760F14450AF915DA1E1DB74A981E7A0

Function 00F67778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

Unterminated group of comments, xrefs: 00FA528C
#cs, xrefs: 00F67873, 00F678C5
#comments-end, xrefs: 00F678D9
#OnAutoItStartRegister, xrefs: 00F67817
#comments-start, xrefs: 00F6785F, 00F678B1
#include, xrefs: 00F67847
#include-once, xrefs: 00F6782F
Bad directive syntax error, xrefs: 00FA519A
", xrefs: 00FA5153
#notrayicon, xrefs: 00F677E7
#pragma compile, xrefs: 00F677D3
#requireadmin, xrefs: 00F677FF
#ce, xrefs: 00F678ED
', xrefs: 00FA5169
Cannot parse #include, xrefs: 00FA5279

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 0f02f20a29626e7009f793c3c666ac7ee56b8ee502e415f2716ead594c0e7e26
Instruction ID: e1488dbdc35eafb36b6a1d9040e0d99f91a1a9f7629cd21955feeb77905303f0
Opcode Fuzzy Hash: 0f02f20a29626e7009f793c3c666ac7ee56b8ee502e415f2716ead594c0e7e26
Instruction Fuzzy Hash: 3781F3B1A04309BBDB20BF60CC42FBE37A8AF15754F144025F905AB196EB78DA05F7A1

Function 00FD3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00FD3EF8
_wcslen.LIBCMT ref: 00FD3F03
_wcslen.LIBCMT ref: 00FD3F5A
_wcslen.LIBCMT ref: 00FD3F98
GetDriveTypeW.KERNEL32(?), ref: 00FD3FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FD401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FD4059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FD4087

Strings

open, xrefs: 00FD3F54, 00FD3F59
set cd door , xrefs: 00FD4028
type cdaudio alias cd wait, xrefs: 00FD4001
wait, xrefs: 00FD4044
close, xrefs: 00FD3EFE, 00FD3F18
closed, xrefs: 00FD3F08, 00FD3F2D, 00FD3F46, 00FD3F7E, 00FD3F97
close cd wait, xrefs: 00FD4072
open , xrefs: 00FD3FE5

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 8e55dbe6f738fee14509256608d4340801dfacc4d2c4a2327220abf306d299d5
Instruction ID: 368f126da1457acc60b864ae5f51da18a9807c9ddab968ec64c04dd6d956f7f0
Opcode Fuzzy Hash: 8e55dbe6f738fee14509256608d4340801dfacc4d2c4a2327220abf306d299d5
Instruction Fuzzy Hash: B5712032A042168FC310EF24C88087AB7F5EF94768F14492EF99697351EB31ED45EB92

Function 00FC5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00FC5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00FC5A40
SetWindowTextW.USER32(?,?), ref: 00FC5A57
GetDlgItem.USER32(?,000003EA), ref: 00FC5A6C
SetWindowTextW.USER32(00000000,?), ref: 00FC5A72
GetDlgItem.USER32(?,000003E9), ref: 00FC5A82
SetWindowTextW.USER32(00000000,?), ref: 00FC5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00FC5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00FC5AC3
GetWindowRect.USER32(?,?), ref: 00FC5ACC
_wcslen.LIBCMT ref: 00FC5B33
SetWindowTextW.USER32(?,?), ref: 00FC5B6F
GetDesktopWindow.USER32 ref: 00FC5B75
GetWindowRect.USER32(00000000), ref: 00FC5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00FC5BD3
GetClientRect.USER32(?,?), ref: 00FC5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00FC5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00FC5C2F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: d4fe957ed6281c4ac18d38c7f482f8aa363177f6e6c782e7ba7a069c83bf867f
Instruction ID: 8ca1f585985859dd002fe35e636f415619e36aba750e9bb5775537ba4b77ffaf
Opcode Fuzzy Hash: d4fe957ed6281c4ac18d38c7f482f8aa363177f6e6c782e7ba7a069c83bf867f
Instruction Fuzzy Hash: 86714A31900A0AAFDB20DFA9CE86FAEBBF5EF48B14F10451CE146A25A0D775B944DB50

Function 00FDFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00FDFE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00FDFE32
LoadCursorW.USER32(00000000,00007F00), ref: 00FDFE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00FDFE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00FDFE53
LoadCursorW.USER32(00000000,00007F01), ref: 00FDFE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00FDFE69
LoadCursorW.USER32(00000000,00007F88), ref: 00FDFE74
LoadCursorW.USER32(00000000,00007F80), ref: 00FDFE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00FDFE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00FDFE95
LoadCursorW.USER32(00000000,00007F85), ref: 00FDFEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00FDFEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00FDFEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00FDFEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00FDFECC
GetCursorInfo.USER32(?), ref: 00FDFEDC
GetLastError.KERNEL32 ref: 00FDFF1E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 940f7e2c29a2eb2be2f6057a452c1aa1ef51357cd1dbc135a6d7a9cea468a8b7
Instruction ID: 5392c09d12b5da089f38654dca74dd6804fad188c0e919ccd6fbc2a85241f71f
Opcode Fuzzy Hash: 940f7e2c29a2eb2be2f6057a452c1aa1ef51357cd1dbc135a6d7a9cea468a8b7
Instruction Fuzzy Hash: D04154B0D04319AADB109FBA8C85C6EBFE9FF04364B54452AE11DEB281DB789905CE91

Function 00F800C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00F800C6

Part of subcall function 00F800ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0103070C,00000FA0,7880A8DD,?,?,?,?,00FA23B3,000000FF), ref: 00F8011C
Part of subcall function 00F800ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00FA23B3,000000FF), ref: 00F80127
Part of subcall function 00F800ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00FA23B3,000000FF), ref: 00F80138
Part of subcall function 00F800ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00F8014E
Part of subcall function 00F800ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00F8015C
Part of subcall function 00F800ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00F8016A
Part of subcall function 00F800ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F80195
Part of subcall function 00F800ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F801A0

___scrt_fastfail.LIBCMT ref: 00F800E7

Part of subcall function 00F800A3: __onexit.LIBCMT ref: 00F800A9

Strings

InitializeConditionVariable, xrefs: 00F80148
kernel32.dll, xrefs: 00F80133
WakeAllConditionVariable, xrefs: 00F80162
SleepConditionVariableCS, xrefs: 00F80154
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00F80122

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: d613635cbf827e04ac5b629231785af090864d2eaeb27b4c6c9e4e01497cb8d0
Instruction ID: 787afae65ac7531c9fd34f42dac34ebcb06f80a317c9a6d6968eec71d71f3353
Opcode Fuzzy Hash: d613635cbf827e04ac5b629231785af090864d2eaeb27b4c6c9e4e01497cb8d0
Instruction Fuzzy Hash: 18212933E417196BE7616B64AD4ABBD339CEF05B71F40013AF941A3291DF688808FB91

Function 00FC30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FC318D
_wcslen.LIBCMT ref: 00FC31F8

Strings

INSTANCE, xrefs: 00FC3453
TEXT, xrefs: 00FC347C
NAME, xrefs: 00FC3335, 00FC3346
CLASS, xrefs: 00FC3188, 00FC31A5
CLASSNN, xrefs: 00FC31F3, 00FC3204
REGEXPCLASS, xrefs: 00FC3255, 00FC3266

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: be919e37618fbde6a96240e735285c79145e6851e7e82e5abd18c0097427947a
Instruction ID: 7bce44212bbff13c3a9a492b0c40f82fb9645ce40d87d17b2f25066c186ffacb
Opcode Fuzzy Hash: be919e37618fbde6a96240e735285c79145e6851e7e82e5abd18c0097427947a
Instruction Fuzzy Hash: A1E1B332E005279ACB18DF68C952FEDBBB4BF547A0F54C11EE456E7240DB30AE45AB90

Function 00FD44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00FFCC08), ref: 00FD4527
_wcslen.LIBCMT ref: 00FD453B
_wcslen.LIBCMT ref: 00FD4599
_wcslen.LIBCMT ref: 00FD45F4
_wcslen.LIBCMT ref: 00FD463F
_wcslen.LIBCMT ref: 00FD46A7

Part of subcall function 00F7F9F2: _wcslen.LIBCMT ref: 00F7F9FD

GetDriveTypeW.KERNEL32(?,01026BF0,00000061), ref: 00FD4743

Strings

cdrom, xrefs: 00FD458F, 00FD4594
unknown, xrefs: 00FD4708
network, xrefs: 00FD469D, 00FD46A2
all, xrefs: 00FD4531, 00FD4536
removable, xrefs: 00FD45EA, 00FD45EF
fixed, xrefs: 00FD4635, 00FD463A
ramdisk, xrefs: 00FD46F1

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 3f818b659b5d0dc1792b8d345830ed586c99accf245853ff7f4855b5cb158323
Instruction ID: 7ccc1fc06d2e83661c4878ca847dc44acf48db0ebb2da05cf60c6b3c05de1cf2
Opcode Fuzzy Hash: 3f818b659b5d0dc1792b8d345830ed586c99accf245853ff7f4855b5cb158323
Instruction Fuzzy Hash: CDB1E231A083029FC710DF28D890A6AF7E6BFA5760F58491EF496C7391D734E844EB92

Function 00FE3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FFCC08), ref: 00FE40BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00FE40CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00FFCC08), ref: 00FE40F2
FreeLibrary.KERNEL32(00000000,?,00FFCC08), ref: 00FE413E
StringFromGUID2.OLE32(?,?,00000028,?,00FFCC08), ref: 00FE41A8
SysFreeString.OLEAUT32(00000009), ref: 00FE4262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00FE42C8
SysFreeString.OLEAUT32(?), ref: 00FE42F2

Strings

GetModuleHandleExW, xrefs: 00FE40C7
kernel32.dll, xrefs: 00FE40B6

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: f15ddb64d0b5c28487b7b17421b932584c0bf6316c4d0b5473dc07d5224a9cc2
Instruction ID: 8b801b266111c2facebc46e2661dfbe5a46391ccf9d3bcf8132127daf9462ee1
Opcode Fuzzy Hash: f15ddb64d0b5c28487b7b17421b932584c0bf6316c4d0b5473dc07d5224a9cc2
Instruction Fuzzy Hash: 40124975A00259EFDB14CF95C884EAEBBB9FF45314F24809CE905AB251C731ED46EBA0

Function 00F6326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(01031990), ref: 00FA2F8D
GetMenuItemCount.USER32(01031990), ref: 00FA303D
GetCursorPos.USER32(?), ref: 00FA3081
SetForegroundWindow.USER32(00000000), ref: 00FA308A
TrackPopupMenuEx.USER32(01031990,00000000,?,00000000,00000000,00000000), ref: 00FA309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00FA30A9

Strings

0, xrefs: 00F6327D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 359eebceb4d816cc8af913e5965a3f790571599154613eb02f48d2297cb02c50
Instruction ID: 73be6f3f0668bfd0f705dd46348fcfeac6dac08c218a3d18db52b07b5e55bab4
Opcode Fuzzy Hash: 359eebceb4d816cc8af913e5965a3f790571599154613eb02f48d2297cb02c50
Instruction Fuzzy Hash: 22712B71B44219BEEB218F28CD49FAABF68FF06334F244206F5156A1D0C7B1A954F791

Function 00FF6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00FF6DEB

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00FF6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00FF6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FF6E94
DestroyWindow.USER32(?), ref: 00FF6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00F60000,00000000), ref: 00FF6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FF6EFD
GetDesktopWindow.USER32 ref: 00FF6F16
GetWindowRect.USER32(00000000), ref: 00FF6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00FF6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00FF6F4D

Part of subcall function 00F79944: GetWindowLongW.USER32(?,000000EB), ref: 00F79952

Strings

0, xrefs: 00FF6D98
tooltips_class32, xrefs: 00FF6E58, 00FF6EDD

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 5cc9eaf299be1017ca97c89868f8084a7c63dc9bb939c03db5d51998a71b5bd8
Instruction ID: 736b70141c342e11ce77bae6c57dafbae2f41a9b8a7376609341bedc8b366731
Opcode Fuzzy Hash: 5cc9eaf299be1017ca97c89868f8084a7c63dc9bb939c03db5d51998a71b5bd8
Instruction Fuzzy Hash: 21717A71504248AFDB21CF18D844BBABBE9FF89710F04081EFA89C72A1DB75AD05EB15

Function 00FF911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

DragQueryPoint.SHELL32(?,?), ref: 00FF9147

Part of subcall function 00FF7674: ClientToScreen.USER32(?,?), ref: 00FF769A
Part of subcall function 00FF7674: GetWindowRect.USER32(?,?), ref: 00FF7710
Part of subcall function 00FF7674: PtInRect.USER32(?,?,00FF8B89), ref: 00FF7720

SendMessageW.USER32(?,000000B0,?,?), ref: 00FF91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00FF91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00FF91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00FF9225
SendMessageW.USER32(?,000000B0,?,?), ref: 00FF923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00FF9255
SendMessageW.USER32(?,000000B1,?,?), ref: 00FF9277
DragFinish.SHELL32(?), ref: 00FF927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00FF9371

Strings

@GUI_DRAGID, xrefs: 00FF92E9
@GUI_DRAGFILE, xrefs: 00FF9320
@GUI_DROPID, xrefs: 00FF929E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 1843520ea2a51118726922ab1095d277f4fc8cee9dc665b2d2c0f125117d7ec7
Instruction ID: 462e3a3bae824048883467066554f1a3f0843a52fe0f6b2eef04ed0de1647a07
Opcode Fuzzy Hash: 1843520ea2a51118726922ab1095d277f4fc8cee9dc665b2d2c0f125117d7ec7
Instruction Fuzzy Hash: 56617971108309AFC701DF60CD85EAFBBE8EF88350F00091EF595931A1DB709A49DB92

Function 00FDC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FDC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00FDC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00FDC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00FDC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00FDC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00FDC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FDC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FDC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00FDC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00FDC5F0
InternetCloseHandle.WININET(00000000), ref: 00FDC5FB

Strings

, xrefs: 00FDC575

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 23ef5756b352afaf687094822961fdb5fe2e325c4e9e6e1e343faa90620b1f53
Instruction ID: 5cdf2de7abaad74714bd5f499bfb7293ed58f09d9e0881c2e69b2648e992294b
Opcode Fuzzy Hash: 23ef5756b352afaf687094822961fdb5fe2e325c4e9e6e1e343faa90620b1f53
Instruction Fuzzy Hash: BB513AB150020ABFDB219F60D988BBB7BBDFF08754F08451AF94696250DB34E944FBA0

Function 00FF856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00FF8592
GetFileSize.KERNEL32(00000000,00000000), ref: 00FF85A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00FF85AD
CloseHandle.KERNEL32(00000000), ref: 00FF85BA
GlobalLock.KERNEL32(00000000), ref: 00FF85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00FF85D7
GlobalUnlock.KERNEL32(00000000), ref: 00FF85E0
CloseHandle.KERNEL32(00000000), ref: 00FF85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00FF85F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00FFFC38,?), ref: 00FF8611
GlobalFree.KERNEL32(00000000), ref: 00FF8621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00FF8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00FF8671
DeleteObject.GDI32(00000000), ref: 00FF8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00FF86AF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 724c07b9bd51b78c37f9d249cc5cee07ac673d288ce81f8f7e6a816881e48976
Instruction ID: e2f92f63fbb74ee9ab1dc441882d3466e32771f3bb97c53690628474426b1805
Opcode Fuzzy Hash: 724c07b9bd51b78c37f9d249cc5cee07ac673d288ce81f8f7e6a816881e48976
Instruction Fuzzy Hash: 8A41F67560021CAFDB119FA5CD48EBA7BBCEF89B61F144058F909EB260DB309D05EB60

Function 00FD14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00FD1502
VariantCopy.OLEAUT32(?,?), ref: 00FD150B
VariantClear.OLEAUT32(?), ref: 00FD1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00FD15FB
VarR8FromDec.OLEAUT32(?,?), ref: 00FD1657
VariantInit.OLEAUT32(?), ref: 00FD1708
SysFreeString.OLEAUT32(?), ref: 00FD178C
VariantClear.OLEAUT32(?), ref: 00FD17D8
VariantClear.OLEAUT32(?), ref: 00FD17E7
VariantInit.OLEAUT32(00000000), ref: 00FD1823

Strings

Default, xrefs: 00FD16AF
%4d%02d%02d%02d%02d%02d, xrefs: 00FD1625

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 54e1c6c440934fe463d6d64c643d7aa182a24880cae49df7c28efa2fc3ab1472
Instruction ID: ac4de16aa075820b90fd4b7db97e671a7721d6aebca5e9936a05c2a12c178b44
Opcode Fuzzy Hash: 54e1c6c440934fe463d6d64c643d7aa182a24880cae49df7c28efa2fc3ab1472
Instruction Fuzzy Hash: 64D1DF72A00115EBDB10AF65E885B7DB7B6BF45700F1C8057E446AB290DB78DC44FBA2

Function 00FEB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FEB6AE,?,?), ref: 00FEC9B5
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FEC9F1
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA68
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FEB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FEB772
RegDeleteValueW.ADVAPI32(?,?), ref: 00FEB80A
RegCloseKey.ADVAPI32(?), ref: 00FEB87E
RegCloseKey.ADVAPI32(?), ref: 00FEB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00FEB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00FEB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00FEB922
FreeLibrary.KERNEL32(00000000), ref: 00FEB983
RegCloseKey.ADVAPI32(00000000), ref: 00FEB994

Strings

RegDeleteKeyExW, xrefs: 00FEB8FE
advapi32.dll, xrefs: 00FEB8ED

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: eeb24c8a144e110f3ba3a9668de1a95c916a69d7ceea52178737a90a168feff6
Instruction ID: 864870f3f4483d50f86947c739a6c358e413fd01e72b482e50ff03fd795194c6
Opcode Fuzzy Hash: eeb24c8a144e110f3ba3a9668de1a95c916a69d7ceea52178737a90a168feff6
Instruction Fuzzy Hash: E8C18E31608241AFD710DF15C895F2ABBE5BF84318F14849CF49A8B3A2CB75ED46EB91

Function 00FE255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FE25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00FE25E8
CreateCompatibleDC.GDI32(?), ref: 00FE25F4
SelectObject.GDI32(00000000,?), ref: 00FE2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00FE266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00FE26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00FE26D0
SelectObject.GDI32(?,?), ref: 00FE26D8
DeleteObject.GDI32(?), ref: 00FE26E1
DeleteDC.GDI32(?), ref: 00FE26E8
ReleaseDC.USER32(00000000,?), ref: 00FE26F3

Strings

(, xrefs: 00FE268D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: ef0647c9265e0e8467fd8f2393b27dd7eb7cad9ee6b406ad26cf97af3dc49cbd
Instruction ID: 63e017c8bb3366884d27925e61802877b6a348cb7ab9e718106ab45456d2e04a
Opcode Fuzzy Hash: ef0647c9265e0e8467fd8f2393b27dd7eb7cad9ee6b406ad26cf97af3dc49cbd
Instruction Fuzzy Hash: 24610375D00219EFCF04CFA4D984AAEBBB9FF48310F208529E555A7250E774A951DF90

Function 00F9DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00F9DAA1

Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D659
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D66B
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D67D
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D68F
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6A1
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6B3
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6C5
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6D7
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6E9
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6FB
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D70D
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D71F
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D731

_free.LIBCMT ref: 00F9DA96

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F9DAB8
_free.LIBCMT ref: 00F9DACD
_free.LIBCMT ref: 00F9DAD8
_free.LIBCMT ref: 00F9DAFA
_free.LIBCMT ref: 00F9DB0D
_free.LIBCMT ref: 00F9DB1B
_free.LIBCMT ref: 00F9DB26
_free.LIBCMT ref: 00F9DB5E
_free.LIBCMT ref: 00F9DB65
_free.LIBCMT ref: 00F9DB82
_free.LIBCMT ref: 00F9DB9A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: eaf90320ca93dac54fe801869cec1abdc7eaf742f54714ff3fde297f9aa7ecc2
Instruction ID: a3b19e995b1f2b26ffb754e057fd4bd1b2dd0abce667ec2ec8d941cf3ff3ef70
Opcode Fuzzy Hash: eaf90320ca93dac54fe801869cec1abdc7eaf742f54714ff3fde297f9aa7ecc2
Instruction Fuzzy Hash: A2315831A04204AFFF61AE39EC45B5AB7E9FF50320F614419E449D7192DB39AC90BB60

Function 00FC365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FC369C
_wcslen.LIBCMT ref: 00FC36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00FC3797
GetClassNameW.USER32(?,?,00000400), ref: 00FC380C
GetDlgCtrlID.USER32(?), ref: 00FC385D
GetWindowRect.USER32(?,?), ref: 00FC3882
GetParent.USER32(?), ref: 00FC38A0
ScreenToClient.USER32(00000000), ref: 00FC38A7
GetClassNameW.USER32(?,?,00000100), ref: 00FC3921
GetWindowTextW.USER32(?,?,00000400), ref: 00FC395D

Strings

%s%u, xrefs: 00FC3734

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: b57d5fda3a03d204a9f15e5e5a7d952def51a1f51ad94edfd6944a09aafe8cb3
Instruction ID: 92bb04485839c4f9e4d08e0443dd7f5ed2faa34b03872afbb6c0b8b88e9be05d
Opcode Fuzzy Hash: b57d5fda3a03d204a9f15e5e5a7d952def51a1f51ad94edfd6944a09aafe8cb3
Instruction Fuzzy Hash: 6791C271604607AFD718DF24C986FEAB7A9FF443A0F00852DF999C2190DB34EA45EB91

Function 00FC4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00FC4994
GetWindowTextW.USER32(?,?,00000400), ref: 00FC49DA
_wcslen.LIBCMT ref: 00FC49EB
CharUpperBuffW.USER32(?,00000000), ref: 00FC49F7
_wcsstr.LIBVCRUNTIME ref: 00FC4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00FC4A64
GetWindowTextW.USER32(?,?,00000400), ref: 00FC4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00FC4AE6
GetClassNameW.USER32(?,?,00000400), ref: 00FC4B20
GetWindowRect.USER32(?,?), ref: 00FC4B8B

Strings

ThumbnailClass, xrefs: 00FC4A6F, 00FC4AF1

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 2f5a10797ed83f7e387771603649518ce0c3ca139232b9524ac75723247b29c9
Instruction ID: 349462001913047953beb7b8f1ff715d778be64f10c9740ecde530474235998c
Opcode Fuzzy Hash: 2f5a10797ed83f7e387771603649518ce0c3ca139232b9524ac75723247b29c9
Instruction Fuzzy Hash: 9C919E7140820A9FDB04DF14CA96FAA77E8FF84324F04846DFD859A096DB34ED45EBA1

Function 00FCBF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(01031990,000000FF,00000000,00000030), ref: 00FCBFAC
SetMenuItemInfoW.USER32(01031990,00000004,00000000,00000030), ref: 00FCBFE1
Sleep.KERNEL32(000001F4), ref: 00FCBFF3
GetMenuItemCount.USER32(?), ref: 00FCC039
GetMenuItemID.USER32(?,00000000), ref: 00FCC056
GetMenuItemID.USER32(?,-00000001), ref: 00FCC082
GetMenuItemID.USER32(?,?), ref: 00FCC0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00FCC10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FCC124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FCC145

Strings

0, xrefs: 00FCBF3D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 70c6c10cc2c502b1e2b7a3928e3e8aa8da8de6983be029d555abc329555ba447
Instruction ID: e8697ac66d4d6727f73b3cd902847ef1419337120b6ecdc6dbf6a5a4395d8f24
Opcode Fuzzy Hash: 70c6c10cc2c502b1e2b7a3928e3e8aa8da8de6983be029d555abc329555ba447
Instruction Fuzzy Hash: EF618CB190025BAFDF11CF64DE8AFBE7BA8EF05354F084019E855A3291D735AD05EBA0

Function 00FECC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00FECC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00FECC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00FECD48

Part of subcall function 00FECC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00FECCAA
Part of subcall function 00FECC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00FECCBD
Part of subcall function 00FECC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00FECCCF
Part of subcall function 00FECC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00FECD05
Part of subcall function 00FECC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00FECD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00FECCF3

Strings

RegDeleteKeyExW, xrefs: 00FECCC9
advapi32.dll, xrefs: 00FECCB8

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: dc6e191c748464f4da5d295000269b7c6b96186e5f87318f3bcccd0731d036cf
Instruction ID: bdeb0e9eea425af77d7cd70ae9798363d2d2e3115bb345a7f597a0ea6fe2c260
Opcode Fuzzy Hash: dc6e191c748464f4da5d295000269b7c6b96186e5f87318f3bcccd0731d036cf
Instruction Fuzzy Hash: 07316C72D0116DBBDB208B56DC88EFFBB7CEF55750F000165F916E2200DA749A46EAE0

Function 00FD3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00FD3D40
_wcslen.LIBCMT ref: 00FD3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FD3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00FD3DBE
RemoveDirectoryW.KERNEL32(?), ref: 00FD3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00FD3E55
CloseHandle.KERNEL32(00000000), ref: 00FD3E60
CloseHandle.KERNEL32(00000000), ref: 00FD3E6B

Strings

\, xrefs: 00FD3D77
:, xrefs: 00FD3D82
\??\%s, xrefs: 00FD3D5B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: a5d478a80693e30960ccebb9b3126b6559e3627d2dbac3d9cd5078f9a032861e
Instruction ID: 136f9df52fc4d2597e9996b9f76949b031cf470fdc21021463cfe8daf5c12b2c
Opcode Fuzzy Hash: a5d478a80693e30960ccebb9b3126b6559e3627d2dbac3d9cd5078f9a032861e
Instruction Fuzzy Hash: 9031907290021DAADB209BA0DC49FEB37BEEF88750F1440B6F609D6160E7749744EB65

Function 00FCE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00FCE6B4

Part of subcall function 00F7E551: timeGetTime.WINMM(?,?,00FCE6D4), ref: 00F7E555

Sleep.KERNEL32(0000000A), ref: 00FCE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00FCE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00FCE727
SetActiveWindow.USER32 ref: 00FCE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00FCE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00FCE773
Sleep.KERNEL32(000000FA), ref: 00FCE77E
IsWindow.USER32 ref: 00FCE78A
EndDialog.USER32(00000000), ref: 00FCE79B

Strings

BUTTON, xrefs: 00FCE719

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 6d725940e4ba8c778b43c0cbbfae487d9b2bac4cfb7bd1bbe64193e52ff8b5c4
Instruction ID: 5bf018655be91238677041ba424bd8f13f6b95d118930e86f7599569c0f389d1
Opcode Fuzzy Hash: 6d725940e4ba8c778b43c0cbbfae487d9b2bac4cfb7bd1bbe64193e52ff8b5c4
Instruction Fuzzy Hash: E121D47120060EAFEB105F21EE8AF353B6DFF58748B045428F455C1161DB7AAC10FB50

Function 00FCE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00FCEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00FCEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FCEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00FCEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00FCEAA7

Strings

close PlayMe, xrefs: 00FCEA6E, 00FCEA9B
play PlayMe, xrefs: 00FCEAA2
alias PlayMe, xrefs: 00FCEA36
play PlayMe wait, xrefs: 00FCEA91
open , xrefs: 00FCEA0C
status PlayMe mode, xrefs: 00FCEA58

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: a116f92be7518dc8b3041ef867f9a0eba27e592dbaae5b7ed8e33c2f0c90cd00
Instruction ID: ed759696a4ff97c77629d632fe1cd09e0af98af4053b5b26885cf82be3ea897b
Opcode Fuzzy Hash: a116f92be7518dc8b3041ef867f9a0eba27e592dbaae5b7ed8e33c2f0c90cd00
Instruction Fuzzy Hash: D1117031B9026A7DD720A7A2DD4AEFF7A7CEBD2B10F40042DB841A6091EEA51905D9B0

Function 00FC9F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FCA012
SetKeyboardState.USER32(?), ref: 00FCA07D
GetAsyncKeyState.USER32(000000A0), ref: 00FCA09D
GetKeyState.USER32(000000A0), ref: 00FCA0B4
GetAsyncKeyState.USER32(000000A1), ref: 00FCA0E3
GetKeyState.USER32(000000A1), ref: 00FCA0F4
GetAsyncKeyState.USER32(00000011), ref: 00FCA120
GetKeyState.USER32(00000011), ref: 00FCA12E
GetAsyncKeyState.USER32(00000012), ref: 00FCA157
GetKeyState.USER32(00000012), ref: 00FCA165
GetAsyncKeyState.USER32(0000005B), ref: 00FCA18E
GetKeyState.USER32(0000005B), ref: 00FCA19C

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c6055241dd82ee056148b5c6d6cc441d30dc846f88bf3ca73dfd7e9fa67d2ba0
Instruction ID: 7caae9023dc39499832287eb8842aa728a93630c7c2d4a532e883a0d630bd40c
Opcode Fuzzy Hash: c6055241dd82ee056148b5c6d6cc441d30dc846f88bf3ca73dfd7e9fa67d2ba0
Instruction Fuzzy Hash: 7751FA20D0878E29FB35DB708A16FEABFB49F01394F08458DD5C2571C2DA94BA4CDB62

Function 00FC5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00FC5CE2
GetWindowRect.USER32(00000000,?), ref: 00FC5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00FC5D59
GetDlgItem.USER32(?,00000002), ref: 00FC5D69
GetWindowRect.USER32(00000000,?), ref: 00FC5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00FC5DCF
GetDlgItem.USER32(?,000003E9), ref: 00FC5DDD
GetWindowRect.USER32(00000000,?), ref: 00FC5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00FC5E31
GetDlgItem.USER32(?,000003EA), ref: 00FC5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00FC5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00FC5E67

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 37d5e5374f89282a33d3e3a887f26454f862f62c0c44eda0b05c03fe6ff7988d
Instruction ID: 28eb1dfabc79e590262a3cea9247d6550ce051628db1eed62efd51d8c26fbf37
Opcode Fuzzy Hash: 37d5e5374f89282a33d3e3a887f26454f862f62c0c44eda0b05c03fe6ff7988d
Instruction Fuzzy Hash: 9A511071A0061AAFDF18CF68DE89EAE7BB9AF48710F108129F516E7290D770AD40DB50

Function 00F78BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F78F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F78BE8,?,00000000,?,?,?,?,00F78BBA,00000000,?), ref: 00F78FC5

DestroyWindow.USER32(?), ref: 00F78C81
KillTimer.USER32(00000000,?,?,?,?,00F78BBA,00000000,?), ref: 00F78D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00FB6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00F78BBA,00000000,?), ref: 00FB69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00F78BBA,00000000,?), ref: 00FB69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00F78BBA,00000000), ref: 00FB69D4
DeleteObject.GDI32(00000000), ref: 00FB69E6

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 91a6783a3bdb34fb6ebda43d228a556fa8cd7dad340adf8128fdad4246ff865a
Instruction ID: 406f02537375dd3da5eb23f8b8b50ba0cf009e3e7b7984c6e695f936442f3c19
Opcode Fuzzy Hash: 91a6783a3bdb34fb6ebda43d228a556fa8cd7dad340adf8128fdad4246ff865a
Instruction Fuzzy Hash: 9161BE31901614DFCB329F15DA4CB65B7F5FF44362F14852AE086965A0CB3AA882EF92

Function 00F79838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00F79944: GetWindowLongW.USER32(?,000000EB), ref: 00F79952

GetSysColor.USER32(0000000F), ref: 00F79862

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 04ddc33199a85cbf0bb42755f87be09cf7f68423892f50e89356d445f701a20d
Instruction ID: 6e2615880fa1808ca3c202886f1e7e6556cea0f39a273a6708a347258828c8cb
Opcode Fuzzy Hash: 04ddc33199a85cbf0bb42755f87be09cf7f68423892f50e89356d445f701a20d
Instruction Fuzzy Hash: 2841F531508618AFDB209F38DC84BB93769EB47330F588646F9A6872E1C3719C41FB52

Function 00FC96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00FAF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00FC9717
LoadStringW.USER32(00000000,?,00FAF7F8,00000001), ref: 00FC9720

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00FAF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00FC9742
LoadStringW.USER32(00000000,?,00FAF7F8,00000001), ref: 00FC9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00FC9866

Strings

Line %d:, xrefs: 00FC97A0
Error: , xrefs: 00FC981D
Line %d (File "%s"):, xrefs: 00FC978F
%s (%d) : ==> %s: %s %s, xrefs: 00FC984A
^ ERROR, xrefs: 00FC97FB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: d1980bc0204779be9f0429e2e5a207f028d4dbdf01281885264b0121a9cdb15f
Instruction ID: a1ff0d0b955fc200cb390487fa0d95793271c427dac5f2f2777db13489c079ae
Opcode Fuzzy Hash: d1980bc0204779be9f0429e2e5a207f028d4dbdf01281885264b0121a9cdb15f
Instruction Fuzzy Hash: 64413E7280421AAACB04EBE0DE47EEE777DEF55340F500069F505B2192EB796F48EB61

Function 00FC06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00FC07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00FC07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00FC07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00FC0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00FC082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00FC0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00FC083C

Strings

SOFTWARE\Classes\, xrefs: 00FC070E
\CLSID, xrefs: 00FC0724
\IPC$, xrefs: 00FC0784

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 4a6d17ff001e3daa2501b8d1f1ab2faa28b84b56105f6389fe9ca591b1346d9b
Instruction ID: 8f9116346dfd0e8ac6f43dde34b2f5ee5b7585354ab23e5a00577c28a4d3b5ae
Opcode Fuzzy Hash: 4a6d17ff001e3daa2501b8d1f1ab2faa28b84b56105f6389fe9ca591b1346d9b
Instruction Fuzzy Hash: 1A414472C0022DABDF15EBA0DD86DEDB778FF44750B044129E901B31A0EB74AE05EBA0

Function 00FF3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00FF403B
CreateCompatibleDC.GDI32(00000000), ref: 00FF4042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00FF4055
SelectObject.GDI32(00000000,00000000), ref: 00FF405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00FF4068
DeleteDC.GDI32(00000000), ref: 00FF4072
GetWindowLongW.USER32(?,000000EC), ref: 00FF407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00FF4092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00FF409E

Strings

static, xrefs: 00FF3FD3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 690bdf7e52c9ffe38ad0cbcfecfe9e1bc28206f51a523c0cf53e8a1e32213535
Instruction ID: b5d732c67c5d48e83f66786f2384cc04f7180bff9dd6522eefb92df72cf1de6b
Opcode Fuzzy Hash: 690bdf7e52c9ffe38ad0cbcfecfe9e1bc28206f51a523c0cf53e8a1e32213535
Instruction Fuzzy Hash: 0C314D3250121DABDF219FA4CD45FEA3B68EF0D320F110211FB58E61A0CB75D861EB94

Function 00FE3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FE3C5C
CoInitialize.OLE32(00000000), ref: 00FE3C8A
CoUninitialize.OLE32 ref: 00FE3C94
_wcslen.LIBCMT ref: 00FE3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00FE3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00FE3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00FE3F0E
CoGetObject.OLE32(?,00000000,00FFFB98,?), ref: 00FE3F2D
SetErrorMode.KERNEL32(00000000), ref: 00FE3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00FE3FC4
VariantClear.OLEAUT32(?), ref: 00FE3FD8

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 8e351d122d23cd83761e184ee764885b4b68481b34b47912728d56512f0b2206
Instruction ID: 3717a1e4d2d9477077a8f4bbddd3dd74679e5d1ba79c16265fa9185562444b4b
Opcode Fuzzy Hash: 8e351d122d23cd83761e184ee764885b4b68481b34b47912728d56512f0b2206
Instruction Fuzzy Hash: BDC167716083499FC710DF29C88892BB7E9FF89754F10495DF98A9B260D730EE05DB92

Function 00FD7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FD7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00FD7B8F
SHGetDesktopFolder.SHELL32(?), ref: 00FD7BA3
CoCreateInstance.OLE32(00FFFD08,00000000,00000001,01026E6C,?), ref: 00FD7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00FD7C74
CoTaskMemFree.OLE32(?,?), ref: 00FD7CCC
SHBrowseForFolderW.SHELL32(?), ref: 00FD7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00FD7D7A
CoTaskMemFree.OLE32(00000000), ref: 00FD7D81
CoTaskMemFree.OLE32(00000000), ref: 00FD7DD6
CoUninitialize.OLE32 ref: 00FD7DDC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: a94f359feb267cb14f5ac372ec9bbf2d5b3991341d74d1cadb4d0103546a947d
Instruction ID: cb52305fcf2c0e2e38cd6da7e84059b0b74ef20f5b7951f492639ae4a69e3052
Opcode Fuzzy Hash: a94f359feb267cb14f5ac372ec9bbf2d5b3991341d74d1cadb4d0103546a947d
Instruction Fuzzy Hash: F8C11C75A04219AFCB14DF64C884DAEBBF9FF48314B188499E81ADB361D730ED45DB90

Function 00FF541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00FF5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FF5515
CharNextW.USER32(00000158), ref: 00FF5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00FF5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00FF559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FF55AC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: bb83e957d817dcd8c21b1b13f279bb87158cdbd595176f67c25b6b1bbf96ab37
Instruction ID: 8e88cdb29cdf782fbfbf9ee725a23cddc2bba7802e08e0bddc852117fd1b4b36
Opcode Fuzzy Hash: bb83e957d817dcd8c21b1b13f279bb87158cdbd595176f67c25b6b1bbf96ab37
Instruction Fuzzy Hash: 70619F3190461DABDF20DF54CC84AFE7B79EF09B35F148145FB25AA2A0D7748A81EB60

Function 00FBFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00FBFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00FBFB08
VariantInit.OLEAUT32(?), ref: 00FBFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00FBFB3A
VariantCopy.OLEAUT32(?,?), ref: 00FBFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00FBFBA1
VariantClear.OLEAUT32(?), ref: 00FBFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00FBFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FBFBCC
VariantClear.OLEAUT32(?), ref: 00FBFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FBFBE9

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 94170e170e44043473ba674813dddd1fd48bcae82e2de31b1aaad7b552861c41
Instruction ID: 9be6b74dc172f257b139b80ac462c736d2ec8bab2da137dd5a06b356907e6bbf
Opcode Fuzzy Hash: 94170e170e44043473ba674813dddd1fd48bcae82e2de31b1aaad7b552861c41
Instruction Fuzzy Hash: 48413D35A0021DDFCB04DF65CC549FEBBB9EF48354F008469E956A7261CB34A949DFA0

Function 00FC9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FC9CA1
GetAsyncKeyState.USER32(000000A0), ref: 00FC9D22
GetKeyState.USER32(000000A0), ref: 00FC9D3D
GetAsyncKeyState.USER32(000000A1), ref: 00FC9D57
GetKeyState.USER32(000000A1), ref: 00FC9D6C
GetAsyncKeyState.USER32(00000011), ref: 00FC9D84
GetKeyState.USER32(00000011), ref: 00FC9D96
GetAsyncKeyState.USER32(00000012), ref: 00FC9DAE
GetKeyState.USER32(00000012), ref: 00FC9DC0
GetAsyncKeyState.USER32(0000005B), ref: 00FC9DD8
GetKeyState.USER32(0000005B), ref: 00FC9DEA

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ffa79c189645d0b31fba4b293c77dbe0d3c14a7a17b1213d111e3f8b95bae918
Instruction ID: 27be0b8047f7a032037e14c57ae1d4d67235b4744ac07c9ade82881a1f8bbb56
Opcode Fuzzy Hash: ffa79c189645d0b31fba4b293c77dbe0d3c14a7a17b1213d111e3f8b95bae918
Instruction Fuzzy Hash: E441D730D0C7CB69FF308660860EBB5BEA06F21364F08405ED9C7661C2DBE459C8E7A1

Function 00FE055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FE05BC
inet_addr.WSOCK32(?), ref: 00FE061C
gethostbyname.WSOCK32(?), ref: 00FE0628
IcmpCreateFile.IPHLPAPI ref: 00FE0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00FE06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00FE06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00FE07B9
WSACleanup.WSOCK32 ref: 00FE07BF

Strings

Ping, xrefs: 00FE0676

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: c27847ca9adfee15797e3fcacd7120d38a3c339972db87c264b04c69c860e675
Instruction ID: 58fbeb7b3fcb35d7288535022c18034a4eb533ac434edaf29fa1f26bbe11eceb
Opcode Fuzzy Hash: c27847ca9adfee15797e3fcacd7120d38a3c339972db87c264b04c69c860e675
Instruction Fuzzy Hash: D991A1359042419FD720DF16C988F16BBE4EF44328F1485A9F4A98B6A2CBB4FC85DF91

Function 00FE8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00FE8CF3

Part of subcall function 00FC8E54: _wcslen.LIBCMT ref: 00FC8E77

_wcslen.LIBCMT ref: 00FE8D4E
_wcslen.LIBCMT ref: 00FE8D9C
_wcslen.LIBCMT ref: 00FE8DDC
_wcslen.LIBCMT ref: 00FE8E6E

Strings

stdcall, xrefs: 00FE8DD6, 00FE8DDB
winapi, xrefs: 00FE8D96, 00FE8D9B
cdecl, xrefs: 00FE8D48, 00FE8D4D
none, xrefs: 00FE8E65, 00FE8E6A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 056157c85d37fadb4fc54efa125b278ee7a77ec7ccc50595f16720f9ca49a18a
Instruction ID: 9799af1e600fd20bffb6934417fb922ea8bc7af6f7488400384d60b9251383da
Opcode Fuzzy Hash: 056157c85d37fadb4fc54efa125b278ee7a77ec7ccc50595f16720f9ca49a18a
Instruction Fuzzy Hash: FD51C532E001569BCB24EFA9CD409BEB7A5BF64360B204219E45AE72C4DF35DD42E790

Function 00FE372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00FE3774
CoUninitialize.OLE32 ref: 00FE377F
CoCreateInstance.OLE32(?,00000000,00000017,00FFFB78,?), ref: 00FE37D9
IIDFromString.OLE32(?,?), ref: 00FE384C
VariantInit.OLEAUT32(?), ref: 00FE38E4
VariantClear.OLEAUT32(?), ref: 00FE3936

Strings

NULL Pointer assignment, xrefs: 00FE381E
Invalid parameter, xrefs: 00FE3865
Failed to create object, xrefs: 00FE37E4, 00FE389A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: d11dcce5caa35141a5c6e92526cc1d8e0d1fbc3021872503cb2acc8e6b418734
Instruction ID: b291089976799f71a7116ffd3dd305b4a54a48a6ba6fccf74753182487d9cff1
Opcode Fuzzy Hash: d11dcce5caa35141a5c6e92526cc1d8e0d1fbc3021872503cb2acc8e6b418734
Instruction Fuzzy Hash: 3C61AF72608351AFD310DF56C88DB6ABBE8EF49714F00085DF5859B291C774EE48EB92

Function 00FD3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00FD33CF

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00FD33F0

Strings

Incorrect parameters to object property !, xrefs: 00FD34AB
"%s" (%d) : ==> %s:%s%s, xrefs: 00FD3504
Error: , xrefs: 00FD34D1
^ ERROR , xrefs: 00FD349E
Line %d (File "%s"):, xrefs: 00FD3443, 00FD345C
"%s" (%d) : ==> %s:, xrefs: 00FD3522

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: bc80a30d20a40f6daf5eb93f9dca076e46e14b74dc74c11c471a4ae6f7565415
Instruction ID: dbf8acae1732cb1cb57cd1e075471de3ffa407d01be176ad82cba97161325441
Opcode Fuzzy Hash: bc80a30d20a40f6daf5eb93f9dca076e46e14b74dc74c11c471a4ae6f7565415
Instruction Fuzzy Hash: D251BE32C0021AAADF15EBA0DE47EEEB379EF15300F144065F50572152EB792F58EB61

Function 00FCB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FCB5FC
_wcslen.LIBCMT ref: 00FCB608
_wcslen.LIBCMT ref: 00FCB64D
_wcslen.LIBCMT ref: 00FCB68C
_wcslen.LIBCMT ref: 00FCB6C7

Strings

EXISTS, xrefs: 00FCB686, 00FCB68B
APPEND, xrefs: 00FCB6C1, 00FCB6C6
REMOVE, xrefs: 00FCB602, 00FCB607
KEYS, xrefs: 00FCB647, 00FCB64C

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 3a9fc860148d2a1b21345abea5db221516f582f28ea5f6096ff632a39a761c81
Instruction ID: e252e10c47d4c07e80684e4a8ce47573f12a9a21d17c96ddc603f18837d08e59
Opcode Fuzzy Hash: 3a9fc860148d2a1b21345abea5db221516f582f28ea5f6096ff632a39a761c81
Instruction Fuzzy Hash: DB41D736E000279ACB205E7DCA93BBE77A5AF60764F24416DE865D7280E735CD41F790

Function 00FD5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FD53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00FD5416
GetLastError.KERNEL32 ref: 00FD5420
SetErrorMode.KERNEL32(00000000,READY), ref: 00FD54A7

Strings

READY, xrefs: 00FD5460, 00FD5468
NOTREADY, xrefs: 00FD544B
UNKNOWN, xrefs: 00FD5444
READONLY, xrefs: 00FD5452
INVALID, xrefs: 00FD5459

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: faa074cd503ec65ddacae1ecf3c96c2e3eeb257eca78cacf4432f3412f111c9f
Instruction ID: 362bf1b3046357f48f12e6f6680ed04dba199b1501c7774f7dd1188e45e57768
Opcode Fuzzy Hash: faa074cd503ec65ddacae1ecf3c96c2e3eeb257eca78cacf4432f3412f111c9f
Instruction Fuzzy Hash: 0231E335E002089FC710DF68C894BAA7BB9FF06715F18805AE805CB392D771DD82EB92

Function 00FF3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00FF3C79
SetMenu.USER32(?,00000000), ref: 00FF3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FF3D10
IsMenu.USER32(?), ref: 00FF3D24
CreatePopupMenu.USER32 ref: 00FF3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FF3D5B
DrawMenuBar.USER32 ref: 00FF3D63

Strings

0, xrefs: 00FF3C54
F, xrefs: 00FF3D4E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 3fd5e665408caca584257fa4d13b7550e76f642abe5479de9a3fc811b3b87c42
Instruction ID: 270129c8346a1332530963cbab85fe25af3a83577b06954f37cdc1d2704e5e2a
Opcode Fuzzy Hash: 3fd5e665408caca584257fa4d13b7550e76f642abe5479de9a3fc811b3b87c42
Instruction Fuzzy Hash: 6C416975A0120DEFDB24DF64D944AAE7BB9FF49350F180029FA46A7360D731AA14EF90

Function 00FC1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00FC1F64
GetDlgCtrlID.USER32 ref: 00FC1F6F
GetParent.USER32 ref: 00FC1F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FC1F8E
GetDlgCtrlID.USER32(?), ref: 00FC1F97
GetParent.USER32(?), ref: 00FC1FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FC1FAE

Strings

ComboBox, xrefs: 00FC1EEC
ListBox, xrefs: 00FC1F21

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 672a9b752030de93a5183a0382fb88c13750b3a2d71d49a43003e60d4906ab4a
Instruction ID: d6d1ace82de00c7274c9b9d18ee37615be1cbbfce157c9fbc3715e4f9b36901b
Opcode Fuzzy Hash: 672a9b752030de93a5183a0382fb88c13750b3a2d71d49a43003e60d4906ab4a
Instruction Fuzzy Hash: 4921C571D04129BBCF05AFA0DD45EFEBBB8EF16350F004119F955A7291CB785914EB60

Function 00FC1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00FC2043
GetDlgCtrlID.USER32 ref: 00FC204E
GetParent.USER32 ref: 00FC206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FC206D
GetDlgCtrlID.USER32(?), ref: 00FC2076
GetParent.USER32(?), ref: 00FC208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FC208D

Strings

ComboBox, xrefs: 00FC1FCD
ListBox, xrefs: 00FC2002

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 6e2b4f6b31c5f5b12699a914cf5bd5a19150958739cd2e6afb518c6268b9ef51
Instruction ID: 6f1a365ef5fc990eb5f85ff447382071263292b833b993c3ecb1a52218f2e86a
Opcode Fuzzy Hash: 6e2b4f6b31c5f5b12699a914cf5bd5a19150958739cd2e6afb518c6268b9ef51
Instruction Fuzzy Hash: 8E21A475D40229BBCF11AFA0DD86FFEBBB8EF15340F00401AF955A71A1DA798914EB60

Function 00FF3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00FF3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00FF3AA0
GetWindowLongW.USER32(?,000000F0), ref: 00FF3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FF3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00FF3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00FF3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00FF3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00FF3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00FF3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00FF3C13

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: c75d583b644450706d87a7393f588d5130fba60a9be51870ca54d76d4909774c
Instruction ID: 8e587bdc0388f80369c733259adb9c6ae3ec6ff1773780c1b784a2e06fcdc160
Opcode Fuzzy Hash: c75d583b644450706d87a7393f588d5130fba60a9be51870ca54d76d4909774c
Instruction Fuzzy Hash: F3615975900248AFDB20DFA8CC81EFE77F8AF49710F10019AFA55A72A1D774AA45EB50

Function 00FCB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FCB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00FCA1E1,?,00000001), ref: 00FCB165
GetWindowThreadProcessId.USER32(00000000), ref: 00FCB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FCA1E1,?,00000001), ref: 00FCB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FCB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00FCA1E1,?,00000001), ref: 00FCB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FCA1E1,?,00000001), ref: 00FCB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00FCA1E1,?,00000001), ref: 00FCB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00FCA1E1,?,00000001), ref: 00FCB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00FCA1E1,?,00000001), ref: 00FCB21D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 7869986e6812fa8ee6884d7cac6c2895f1e26aea57427721a104f3ba63ce8fc7
Instruction ID: f0f71e83d38af384775be15ca014b70f998ee9e5ac97451300ad71a4abd5c43a
Opcode Fuzzy Hash: 7869986e6812fa8ee6884d7cac6c2895f1e26aea57427721a104f3ba63ce8fc7
Instruction Fuzzy Hash: 5631AE79900209AFDB259F24DE9AFBDBBADBF51321F104008FA05DA180D7B89C40EF60

Function 00F92C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F92C94

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F92CA0
_free.LIBCMT ref: 00F92CAB
_free.LIBCMT ref: 00F92CB6
_free.LIBCMT ref: 00F92CC1
_free.LIBCMT ref: 00F92CCC
_free.LIBCMT ref: 00F92CD7
_free.LIBCMT ref: 00F92CE2
_free.LIBCMT ref: 00F92CED
_free.LIBCMT ref: 00F92CFB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 89157ee138a38ddf4e7b2d131649af015b68b9dde12a98b8a1a93712e9885ef3
Instruction ID: 16c4e62c042eaef83a5999f9bd3fd1744ac31ba081ed05080ef143d97863e515
Opcode Fuzzy Hash: 89157ee138a38ddf4e7b2d131649af015b68b9dde12a98b8a1a93712e9885ef3
Instruction Fuzzy Hash: E5116276500108BFEF82EF58DD82CDD3BB5BF05350F5145A5FA489B222DA35EA50AB90

Function 00F61410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00F61459
OleUninitialize.OLE32(?,00000000), ref: 00F614F8
UnregisterHotKey.USER32(?), ref: 00F616DD
DestroyWindow.USER32(?), ref: 00FA24B9
FreeLibrary.KERNEL32(?), ref: 00FA251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00FA254B

Strings

close all, xrefs: 00F61454

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 7426d9e222bb5f53d875cdd59f7dfc4ba01421054f62a0af492d194c92a39c23
Instruction ID: 1d10e7ab46956b94308b12c1fbf3e95c08887e5e42c6169ee8959c05c0572cd9
Opcode Fuzzy Hash: 7426d9e222bb5f53d875cdd59f7dfc4ba01421054f62a0af492d194c92a39c23
Instruction Fuzzy Hash: 86D1A271B01212CFCB29EF19C995B29F7A4BF05710F18429DE44A6B262DB31EC16EF91

Function 00FD7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FD7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD7FC1
GetFileAttributesW.KERNEL32(?), ref: 00FD7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00FD8005
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD8017
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00FD80B0

Strings

*.*, xrefs: 00FD8066

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 07daf2528b0435453b99cb706d9310b5ac1d10c7da8b7c108be02280a918d788
Instruction ID: 435d20e72ab86a885ed433fbff7c8cf36316cf004ffef195ab65e3e25da97556
Opcode Fuzzy Hash: 07daf2528b0435453b99cb706d9310b5ac1d10c7da8b7c108be02280a918d788
Instruction Fuzzy Hash: 258193729083459BC720EF15C844AAAB3EABF84364F18485FF885CB350E775DD45AB92

Function 00F65BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00F65C7A

Part of subcall function 00F65D0A: GetClientRect.USER32(?,?), ref: 00F65D30
Part of subcall function 00F65D0A: GetWindowRect.USER32(?,?), ref: 00F65D71
Part of subcall function 00F65D0A: ScreenToClient.USER32(?,?), ref: 00F65D99

GetDC.USER32 ref: 00FA46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00FA4708
SelectObject.GDI32(00000000,00000000), ref: 00FA4716
SelectObject.GDI32(00000000,00000000), ref: 00FA472B
ReleaseDC.USER32(?,00000000), ref: 00FA4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00FA47C4

Strings

U, xrefs: 00FA4693

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: bdbff747c9d1a5ac7cdef215525daf90fc47005ea8bf2fd49cec38cd601c6ea4
Instruction ID: 3237269a8ea64719343ffcade346904dd8b7294e1681335e37fbe6f999e1d736
Opcode Fuzzy Hash: bdbff747c9d1a5ac7cdef215525daf90fc47005ea8bf2fd49cec38cd601c6ea4
Instruction Fuzzy Hash: 08710171800249DFCF218F64C984ABA7BB5FF8B320F144269ED556A2A6C775A841FF60

Function 00FD359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00FD35E4

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

LoadStringW.USER32(01032390,?,00000FFF,?), ref: 00FD360A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00FD3724
Error: , xrefs: 00FD36EF
Line %d (File "%s"):, xrefs: 00FD366B
"%s" (%d) : ==> %s:, xrefs: 00FD3742
^ ERROR, xrefs: 00FD36C9

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 201ac4a713f826ab5d346e77fcbb886dad47cadb5e4993da0a99f0403542da09
Instruction ID: 624cc5c84e53a2fa6f9598bf0361594070d7b55281d243643d415466c471bec5
Opcode Fuzzy Hash: 201ac4a713f826ab5d346e77fcbb886dad47cadb5e4993da0a99f0403542da09
Instruction Fuzzy Hash: DE517E72C0421ABACF14EBA0CD42EEDBB79EF14300F144125F50572291EB755B98EFA1

Function 00FDC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FDC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FDC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FDC2CA
GetLastError.KERNEL32 ref: 00FDC322
SetEvent.KERNEL32(?), ref: 00FDC336
InternetCloseHandle.WININET(00000000), ref: 00FDC341

Strings

, xrefs: 00FDC2BB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: c087dfdceeedb5443ed53de55113bbcaa58ba01cf9cff334b7abb8b0dcf90884
Instruction ID: 9f76077b9c55ba9ac0b14c1bd2a23916d4605abdb81d028a154f227220004b08
Opcode Fuzzy Hash: c087dfdceeedb5443ed53de55113bbcaa58ba01cf9cff334b7abb8b0dcf90884
Instruction Fuzzy Hash: 76316DB2500209AFDB21AF658D88ABB7BFDEF49754B18851EF446D2310DB34DD04EBA0

Function 00FC989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00FA3AAF,?,?,Bad directive syntax error,00FFCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00FC98BC
LoadStringW.USER32(00000000,?,00FA3AAF,?), ref: 00FC98C3

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00FC9987

Strings

Error: , xrefs: 00FC9955
., xrefs: 00FC996D
%s (%d) : ==> %s.: %s %s, xrefs: 00FC98F1
Line %d:, xrefs: 00FC9912
Line %d (File "%s"):, xrefs: 00FC992D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 9c4967897fcd298f8b49d07cf958f2512f7a94cc289c7a6b5525c65cc3006f56
Instruction ID: 76128ee69e7d00ee792dffe5921adabbdab61cdf7a4c297602623ffc36ed704e
Opcode Fuzzy Hash: 9c4967897fcd298f8b49d07cf958f2512f7a94cc289c7a6b5525c65cc3006f56
Instruction Fuzzy Hash: F9215E32C0422EABCF15AF90CD0AEFE7779FF18700F044459F51966062EB759618EB51

Function 00FC209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00FC20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00FC20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00FC214D

Strings

SHELLDLL_DefView, xrefs: 00FC20CC
details, xrefs: 00FC20FB
largeicons, xrefs: 00FC20E1
list, xrefs: 00FC212F
smallicons, xrefs: 00FC2115

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 991d7b8ad314c11be99e0b77e4a716985ee76cfb83674fd841cffa622e9e411a
Instruction ID: 8725226bf120c8708e0bedac92b9f1cf9a6a325be207ac61d3020a181b7b7da1
Opcode Fuzzy Hash: 991d7b8ad314c11be99e0b77e4a716985ee76cfb83674fd841cffa622e9e411a
Instruction Fuzzy Hash: 3911CA77A8832BB9F6057621DD07EF6779CDF05724B20012EF704A90A1FE6568417A58

Function 00F98D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f6ee0289e0af93656f42102f92de4e62e69a555db7bc6c301487a69d2997ee
Instruction ID: d72901b91d37b9220e4c5f205945d8eb718a400ce3662c091c3555ffe7718fb2
Opcode Fuzzy Hash: b2f6ee0289e0af93656f42102f92de4e62e69a555db7bc6c301487a69d2997ee
Instruction Fuzzy Hash: 02C1F775D08249AFEF11EFACC841BAD7BB4BF0A320F054059F514A7392C7759941EB61

Function 00F9CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F9CEB7
_free.LIBCMT ref: 00F9CF22
_free.LIBCMT ref: 00F9CF48
_free.LIBCMT ref: 00F9CF71
_free.LIBCMT ref: 00F9CFA9
_free.LIBCMT ref: 00F9CFDA
_free.LIBCMT ref: 00F9D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00F9D09C
_free.LIBCMT ref: 00F9D0B5

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 0960cf40375eac29e06f76eeff7919a0828d642473f6010f0cb34970b7e6c241
Instruction ID: ed21a3cca565919a703902ba9508674369ae0477e55e86dcc802c50d730c5adc
Opcode Fuzzy Hash: 0960cf40375eac29e06f76eeff7919a0828d642473f6010f0cb34970b7e6c241
Instruction Fuzzy Hash: A0616472D04200AFFF31AF789C85A6D7BA9AF05364F14416DF94597289D73A9D00B7E0

Function 00FF50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00FF5186
ShowWindow.USER32(?,00000000), ref: 00FF51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00FF51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00FF51D1

Part of subcall function 00FF6FBA: DeleteObject.GDI32(00000000), ref: 00FF6FE6

GetWindowLongW.USER32(?,000000F0), ref: 00FF520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FF521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00FF524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00FF5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00FF5296

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: be65b60120883955aac817e871a993efdc7c49547e071a7d2f9f9b44497ffe9c
Instruction ID: cc935ca06469614916860704ee6d1ef9f4c0fddf45f050db00c28d7845e60c38
Opcode Fuzzy Hash: be65b60120883955aac817e871a993efdc7c49547e071a7d2f9f9b44497ffe9c
Instruction Fuzzy Hash: 1D518031A44A0CBEEF249F64CC45BF93B65AF05B21F148212F719962F0C7B5A980FB41

Function 00F78B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00FB6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00FB68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00FB68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00FB68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00FB68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00F78874,00000000,00000000,00000000,000000FF,00000000), ref: 00FB6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00FB691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00F78874,00000000,00000000,00000000,000000FF,00000000), ref: 00FB692D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 36b51801338d0495505c646d7ca7e3fd6a4cf6d13651ad3b530956620b1c1646
Instruction ID: a2cc0a1c7fa244e4afb8613a82ae35f7d53fa65a826e991452a6b44e705a7b58
Opcode Fuzzy Hash: 36b51801338d0495505c646d7ca7e3fd6a4cf6d13651ad3b530956620b1c1646
Instruction Fuzzy Hash: 71517B70A00209EFDB20CF29CC45FAA7BB5EF88760F108519F94AD72A0DB75E951EB50

Function 00FDC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FDC182
GetLastError.KERNEL32 ref: 00FDC195
SetEvent.KERNEL32(?), ref: 00FDC1A9

Part of subcall function 00FDC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FDC272
Part of subcall function 00FDC253: GetLastError.KERNEL32 ref: 00FDC322
Part of subcall function 00FDC253: SetEvent.KERNEL32(?), ref: 00FDC336
Part of subcall function 00FDC253: InternetCloseHandle.WININET(00000000), ref: 00FDC341

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: a031c0d22fdfe3dd3e19587cd7afdf69d89d9dcc45d3966083c89f8acefa66e1
Instruction ID: 9f35d04b724e1aab74461b00686ff59493b23402605bb41bcd8bc0a0f3417f4b
Opcode Fuzzy Hash: a031c0d22fdfe3dd3e19587cd7afdf69d89d9dcc45d3966083c89f8acefa66e1
Instruction Fuzzy Hash: 09316B7260061AAFDB219FA59D44A76BBEAFF18311B18441EF95682720D731E814FBE0

Function 00FC25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC3A57
Part of subcall function 00FC3A3D: GetCurrentThreadId.KERNEL32 ref: 00FC3A5E
Part of subcall function 00FC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00FC25B3), ref: 00FC3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00FC25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00FC25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00FC25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FC25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00FC2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00FC2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FC260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00FC2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00FC2627

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: a3e35a716b056c1ca2cd425f160d06d8b4c2eff120ab8dda9da6feab49f297a9
Instruction ID: 2a829e7b0674a567873f93b8001a3d783a54810f236b2f4b77d6d5cc5909701f
Opcode Fuzzy Hash: a3e35a716b056c1ca2cd425f160d06d8b4c2eff120ab8dda9da6feab49f297a9
Instruction Fuzzy Hash: 2C01D831394228BBFB1067699C8BF693F5DDF4EB51F100005F318AE0D1C9F15454EAA9

Function 00FC1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00FC1449,?,?,00000000), ref: 00FC180C
HeapAlloc.KERNEL32(00000000,?,00FC1449,?,?,00000000), ref: 00FC1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00FC1449,?,?,00000000), ref: 00FC1828
GetCurrentProcess.KERNEL32(?,00000000,?,00FC1449,?,?,00000000), ref: 00FC1830
DuplicateHandle.KERNEL32(00000000,?,00FC1449,?,?,00000000), ref: 00FC1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00FC1449,?,?,00000000), ref: 00FC1843
GetCurrentProcess.KERNEL32(00FC1449,00000000,?,00FC1449,?,?,00000000), ref: 00FC184B
DuplicateHandle.KERNEL32(00000000,?,00FC1449,?,?,00000000), ref: 00FC184E
CreateThread.KERNEL32(00000000,00000000,00FC1874,00000000,00000000,00000000), ref: 00FC1868

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: bdc30cdac70a27a428e063b54a364e8d1bc4e9011ac4a385b1e676066a24b5a3
Instruction ID: d0ed690e0f4863549031845b2512344910d6130b7517be4de163e453d94b6b44
Opcode Fuzzy Hash: bdc30cdac70a27a428e063b54a364e8d1bc4e9011ac4a385b1e676066a24b5a3
Instruction Fuzzy Hash: 2101BF7524030CBFE710AB65DD4DF673B6CEF89B11F004411FA05DB192C6709814EB60

Function 00FEA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00FCD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00FCD501
Part of subcall function 00FCD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00FCD50F
Part of subcall function 00FCD4DC: CloseHandle.KERNEL32(00000000), ref: 00FCD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FEA16D
GetLastError.KERNEL32 ref: 00FEA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FEA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FEA268
GetLastError.KERNEL32(00000000), ref: 00FEA273
CloseHandle.KERNEL32(00000000), ref: 00FEA2C4

Strings

SeDebugPrivilege, xrefs: 00FEA18F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 558609da97d3e14a7d0bc5848dac6c6f78112c4eccb46775471566449b703814
Instruction ID: 8b6d725d9fb3e9182a3b3f79434ee9ded57c21a71b50a39c7db1377009398f40
Opcode Fuzzy Hash: 558609da97d3e14a7d0bc5848dac6c6f78112c4eccb46775471566449b703814
Instruction Fuzzy Hash: 6461DF306042829FD320DF15C894F25BBE5AF44318F18848CE5A68B7A3C776FC45EB92

Function 00FF3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00FF3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00FF393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00FF3954
_wcslen.LIBCMT ref: 00FF3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00FF39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00FF39F4

Strings

SysListView32, xrefs: 00FF38F7

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: e0fb2279a14b82998dcb191267eb09310cfd7c0c3f3853f65ffdc8088a960a82
Instruction ID: 88434d6ba049c00f996aa5dbd7800861ab26d12fcb70bed46d55bb5981f2aec3
Opcode Fuzzy Hash: e0fb2279a14b82998dcb191267eb09310cfd7c0c3f3853f65ffdc8088a960a82
Instruction Fuzzy Hash: 0C417371E0021DABDF219F64CC45FFA77A9EF08360F100526FA58E7291D7B59984EB90

Function 00FCBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FCBCFD
IsMenu.USER32(00000000), ref: 00FCBD1D
CreatePopupMenu.USER32 ref: 00FCBD53
GetMenuItemCount.USER32(010E5B58), ref: 00FCBDA4
InsertMenuItemW.USER32(010E5B58,?,00000001,00000030), ref: 00FCBDCC

Strings

0, xrefs: 00FCBCA8
2, xrefs: 00FCBD37

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: fb1216437414bd2ef7129640a4d01f1e5e64a07c65a10f947dee4542201da0d7
Instruction ID: 2232118b567f1289e53c245d1f4372ded3d17873ebaf5b9c8652ce8b143b4ea0
Opcode Fuzzy Hash: fb1216437414bd2ef7129640a4d01f1e5e64a07c65a10f947dee4542201da0d7
Instruction Fuzzy Hash: A451D074A0020A9BDF10CFA8DA8BFAEBBF8BF45324F14415DE402D7290D7709945EBA1

Function 00FCC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00FCC913

Strings

blank, xrefs: 00FCC895
info, xrefs: 00FCC8B4
question, xrefs: 00FCC8CC
stop, xrefs: 00FCC8E4
warning, xrefs: 00FCC8FC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 22933b8da257b0f9e6ef06ed026f24c7fe3db9e43e64f6fd153b7e8c990391b6
Instruction ID: 1c83c7319e8f36286ecb9359a1df260f27b18a07c95eca571d571f532a0f68dc
Opcode Fuzzy Hash: 22933b8da257b0f9e6ef06ed026f24c7fe3db9e43e64f6fd153b7e8c990391b6
Instruction Fuzzy Hash: 14112E32A89317BAE704AB559D83EEB379CDF15760B10002EF904AA181E775AD0073E4

Function 00FCDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FCDE42
gethostname.WSOCK32(?,00000100), ref: 00FCDE5C
gethostbyname.WSOCK32(?), ref: 00FCDE69
inet_ntoa.WSOCK32(?), ref: 00FCDEAB
_strcat.LIBCMT ref: 00FCDEB9
WSACleanup.WSOCK32 ref: 00FCDEDE

Strings

0.0.0.0, xrefs: 00FCDE87

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 8962dd4fbbdc512d9afee0c1f8bc7185272e252f1079c9605cc1bf42f9018b59
Instruction ID: 94026d4070a3f3488f09b3f0b4a2c94204e85e8a17e912123faeae2c8a0572ad
Opcode Fuzzy Hash: 8962dd4fbbdc512d9afee0c1f8bc7185272e252f1079c9605cc1bf42f9018b59
Instruction Fuzzy Hash: 6D11D57290411AABCB247B20DD0AEEE776C9F14720F01017AF5459A091EFB59A85EB90

Function 00FF9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

GetSystemMetrics.USER32(0000000F), ref: 00FF9FC7
GetSystemMetrics.USER32(0000000F), ref: 00FF9FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00FFA224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00FFA242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00FFA263
ShowWindow.USER32(00000003,00000000), ref: 00FFA282
InvalidateRect.USER32(?,00000000,00000001), ref: 00FFA2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00FFA2CA

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 5f54e7792ab6313b4e1bae382f7056a3ecf246cec9c34bb76975b8cf5cb45e6b
Instruction ID: 1b4eed2b3a43a17277b539cbb1288bac8670aaa1461f9ef2a1945c1723e76fd7
Opcode Fuzzy Hash: 5f54e7792ab6313b4e1bae382f7056a3ecf246cec9c34bb76975b8cf5cb45e6b
Instruction Fuzzy Hash: 27B1BC71A00219DFDF14CF68C9857BE3BB2FF44711F09806AEE499B2A5D731A940EB51

Function 00FCED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00FCED2A
_wcslen.LIBCMT ref: 00FCED3B
_wcslen.LIBCMT ref: 00FCED79
_wcslen.LIBCMT ref: 00FCEDAF
_wcslen.LIBCMT ref: 00FCEDDF
_wcslen.LIBCMT ref: 00FCEDEF
_wcslen.LIBCMT ref: 00FCEE2B
_wcslen.LIBCMT ref: 00FCEE5A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 42d7671c575e4a8a5fbca436451b0a6a511972a0c30e869a95c68c70c72f30bf
Instruction ID: 466a3cd0ecf3e24ad6cf2f70bfe45102671a594a14aac797537bc5ce55ca36e8
Opcode Fuzzy Hash: 42d7671c575e4a8a5fbca436451b0a6a511972a0c30e869a95c68c70c72f30bf
Instruction Fuzzy Hash: 92419265C1021976CB21FBF48C8BECFB7A8AF45710F508466E518E3162FB38E255D3A5

Function 00F7F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00FB682C,00000004,00000000,00000000), ref: 00F7F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00FB682C,00000004,00000000,00000000), ref: 00FBF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00FB682C,00000004,00000000,00000000), ref: 00FBF454

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 459eac916354d7a6165a4b987b4af8049cfb15a9a6d583c04283a79f48a8cfa7
Instruction ID: a73d98fbe8c521c91e9536b741091f4ce473844aaccc01753caedb5801a60243
Opcode Fuzzy Hash: 459eac916354d7a6165a4b987b4af8049cfb15a9a6d583c04283a79f48a8cfa7
Instruction Fuzzy Hash: D9412C32908644BAC7349B2DCD887767BB6AF45320F18C03EE28F56560D676948CFF52

Function 00FF2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FF2D1B
GetDC.USER32(00000000), ref: 00FF2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FF2D2E
ReleaseDC.USER32(00000000,00000000), ref: 00FF2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00FF2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00FF2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00FF5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00FF2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00FF2DE1

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: dd2e15bc15c9847f5fa3f849ba0e921d4afb8c4097906230b46ab3ac5e7d8726
Instruction ID: 1a5947b9dfc8260827eb4fe75b106e75be09e00075ccf16cb5f719df9a45e1bf
Opcode Fuzzy Hash: dd2e15bc15c9847f5fa3f849ba0e921d4afb8c4097906230b46ab3ac5e7d8726
Instruction Fuzzy Hash: 95318D72201628BBEB118F50CC89FFB3BADEF09721F044055FE08EA2A1C6759C51D7A0

Function 00FC5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00FC5637
_memcmp.LIBVCRUNTIME ref: 00FC5659
_memcmp.LIBVCRUNTIME ref: 00FC5671
_memcmp.LIBVCRUNTIME ref: 00FC5684
_memcmp.LIBVCRUNTIME ref: 00FC569E
_memcmp.LIBVCRUNTIME ref: 00FC56B1
_memcmp.LIBVCRUNTIME ref: 00FC56C9
_memcmp.LIBVCRUNTIME ref: 00FC56E4

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 41afbd64daf8c1dc065d7bc1b61c31a8c6c800eb31eeb30f5088338869ef00a4
Instruction ID: 29f0099d984eabeac09e251e9cc8e450f516f5f120983420f34af77e18d2f16d
Opcode Fuzzy Hash: 41afbd64daf8c1dc065d7bc1b61c31a8c6c800eb31eeb30f5088338869ef00a4
Instruction Fuzzy Hash: A621FC62A4091F77D61465108F83FFB335CBF51B94F440028FE059A541F725FE95B2A9

Function 00FE4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00FE502E, 00FE5383
Not an Object type, xrefs: 00FE5007

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 6838cf2460c43cc2f6d7cfff7470611f68509baa775aa6b5d1fed46af6f82bf1
Instruction ID: 9691039940d3d5fefab8f2a1598222808e1e7ff491ea82b5d55b50a8fcf363d6
Opcode Fuzzy Hash: 6838cf2460c43cc2f6d7cfff7470611f68509baa775aa6b5d1fed46af6f82bf1
Instruction Fuzzy Hash: 8FD1E271E0064A9FDF10CFA9C881BAEB7B5BF48718F148069E915EB281E770DD45DB90

Function 00FA1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00FA15CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00FA1651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00FA16E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00FA16FB

Part of subcall function 00F93820: RtlAllocateHeap.NTDLL(00000000,?,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6,?,00F61129), ref: 00F93852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00FA1777
__freea.LIBCMT ref: 00FA17A2
__freea.LIBCMT ref: 00FA17AE

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: b5e1e65c20d55412c44cba05573cd656b688417fe9d01b831b822f3a3ad157e1
Instruction ID: cf487835a09ac38535ca6f66e645316986227d3419ca87b0a67f4f10f7178c64
Opcode Fuzzy Hash: b5e1e65c20d55412c44cba05573cd656b688417fe9d01b831b822f3a3ad157e1
Instruction Fuzzy Hash: EC91C7B2E102169EDF249E74CD41EEE7BB5BF46320F1A4659E801E7281D735DC44EBA0

Function 00FE4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FE4648
VariantInit.OLEAUT32(?), ref: 00FE4749
VariantClear.OLEAUT32(?), ref: 00FE4753
VariantClear.OLEAUT32(?), ref: 00FE47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00FE472C
Null Object assignment in FOR..IN loop, xrefs: 00FE45D8, 00FE4706, 00FE47BE

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 6032bae8589f5a3d6773246818144b5d86c91509bb8c9a029a18bdc346fb029b
Instruction ID: fdf6f5448791bc41bb6bc7adfe6583de0725a12884717499602b1fee89ca7a6a
Opcode Fuzzy Hash: 6032bae8589f5a3d6773246818144b5d86c91509bb8c9a029a18bdc346fb029b
Instruction Fuzzy Hash: 38917071E00259ABDF20CFA6CC44FAEBBB9EF46720F10855DF505AB280D770A945DBA0

Function 00FD1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00FD125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00FD1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00FD12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FD12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FD135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FD13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FD1430

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: e578a2f507a26345e53c85fcc280c23549734a4be9cc51e0d83e4c7108b1c24a
Instruction ID: f543eb3ef4b927c0b56c058612ea6e428303238d10cba9b021472a5c4df0b763
Opcode Fuzzy Hash: e578a2f507a26345e53c85fcc280c23549734a4be9cc51e0d83e4c7108b1c24a
Instruction Fuzzy Hash: FD91D472E00219AFDB00DF94C884BBE77BAFF46725F18412AE540E7391D779A941EB90

Function 00F7948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8f3cbe273116fdfcf1955890af8b69424d202f27e6da1010c876884a86758b3f
Instruction ID: 82d0f14144e106b9f4f46f02850de1df380e3c024c336f59774ea8173af11ec4
Opcode Fuzzy Hash: 8f3cbe273116fdfcf1955890af8b69424d202f27e6da1010c876884a86758b3f
Instruction Fuzzy Hash: 29910771D04219AFCB10CFA9CC84AEEBBB8FF49320F18855AE515B7251D778A942DF60

Function 00FE3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FE396B
CharUpperBuffW.USER32(?,?), ref: 00FE3A7A
_wcslen.LIBCMT ref: 00FE3A8A
VariantClear.OLEAUT32(?), ref: 00FE3C1F

Part of subcall function 00FD0CDF: VariantInit.OLEAUT32(00000000), ref: 00FD0D1F
Part of subcall function 00FD0CDF: VariantCopy.OLEAUT32(?,?), ref: 00FD0D28
Part of subcall function 00FD0CDF: VariantClear.OLEAUT32(?), ref: 00FD0D34

Strings

Incorrect Parameter format, xrefs: 00FE39A6, 00FE3BA1
AUTOIT.ERROR, xrefs: 00FE3A80, 00FE3A85

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 8521b5f67d95effea3531ac58a6c8f7bd28c2bd808ec70054e8ee0779b7b7d6f
Instruction ID: aa23dce3a93de84f075ff2acaa63ad0a56bfbce4994e77a330fbf0d200176580
Opcode Fuzzy Hash: 8521b5f67d95effea3531ac58a6c8f7bd28c2bd808ec70054e8ee0779b7b7d6f
Instruction Fuzzy Hash: 1991AD75A083459FC700DF25C88892AB7E5FF88714F14886EF88A97351DB34EE45EB82

Function 00FE4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00FC000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?,?,00FC035E), ref: 00FC002B
Part of subcall function 00FC000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?), ref: 00FC0046
Part of subcall function 00FC000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?), ref: 00FC0054
Part of subcall function 00FC000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?), ref: 00FC0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00FE4C51
_wcslen.LIBCMT ref: 00FE4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00FE4DCF
CoTaskMemFree.OLE32(?), ref: 00FE4DDA

Strings

NULL Pointer assignment, xrefs: 00FE4E23, 00FE4E52

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 60cfbc5001cafe5d94f5c078c9bdb50242636dc403e7c287b43bf8a38575b6e2
Instruction ID: 5b6bfa6c8ff38d3b5e281912948f09ffaeaf4b817bb99075afd0c87da6e41598
Opcode Fuzzy Hash: 60cfbc5001cafe5d94f5c078c9bdb50242636dc403e7c287b43bf8a38575b6e2
Instruction Fuzzy Hash: 57911671D0025D9BDF14DFA5CC91AEEB7B8BF08310F10416AE915B7291DB74AA44EFA0

Function 00FF20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00FF2183
GetMenuItemCount.USER32(00000000), ref: 00FF21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00FF21DD
_wcslen.LIBCMT ref: 00FF2213
GetMenuItemID.USER32(?,?), ref: 00FF224D
GetSubMenu.USER32(?,?), ref: 00FF225B

Part of subcall function 00FC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC3A57
Part of subcall function 00FC3A3D: GetCurrentThreadId.KERNEL32 ref: 00FC3A5E
Part of subcall function 00FC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00FC25B3), ref: 00FC3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00FF22E3

Part of subcall function 00FCE97B: Sleep.KERNELBASE ref: 00FCE9F3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: f7debcecc518fc681c94d67e37a2dfa7627ae707a9b5f6f9fab38d8607e9d40d
Instruction ID: 716da7bfd0b6ca159e022d5c16f56d1b823d81f7fb0c05df6df7957517207648
Opcode Fuzzy Hash: f7debcecc518fc681c94d67e37a2dfa7627ae707a9b5f6f9fab38d8607e9d40d
Instruction Fuzzy Hash: 39718F75E00209AFCB50DFA4C841ABEB7B5EF48320F148459E956EB361D738AD41EB90

Function 00FF7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(010E5C48), ref: 00FF7F37
IsWindowEnabled.USER32(010E5C48), ref: 00FF7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00FF801E
SendMessageW.USER32(010E5C48,000000B0,?,?), ref: 00FF8051
IsDlgButtonChecked.USER32(?,?), ref: 00FF8089
GetWindowLongW.USER32(010E5C48,000000EC), ref: 00FF80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00FF80C3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: ce43e0e3872e7cf3010a950ccc60cfe00fac8f3006433ed7d0ffebf31dc90c89
Instruction ID: f31c7e0744b8c36301fbc50ecd312576edf4341feda1faaf479e1c987bff0e9b
Opcode Fuzzy Hash: ce43e0e3872e7cf3010a950ccc60cfe00fac8f3006433ed7d0ffebf31dc90c89
Instruction Fuzzy Hash: 3571B334A0834DAFDB21AF54CC84FFABBB9EF09350F144459EA55972B1CB31A845EB50

Function 00FCAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00FCAEF9
GetKeyboardState.USER32(?), ref: 00FCAF0E
SetKeyboardState.USER32(?), ref: 00FCAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00FCAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00FCAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00FCAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00FCB020

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 0178433cfc866a4c7fcc7454799db0207d041ffd3820e960268b7a60e3917c1b
Instruction ID: 8697bc4c69f53319fea991a0ef2f3c0f5c99095ba65ca05ae25bc89bf258ba17
Opcode Fuzzy Hash: 0178433cfc866a4c7fcc7454799db0207d041ffd3820e960268b7a60e3917c1b
Instruction Fuzzy Hash: 3B51C3A0A446DA3DFB3642348D47FBA7EA95B06318F08848DE1D9854C2C3E9AC84E752

Function 00FCACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00FCAD19
GetKeyboardState.USER32(?), ref: 00FCAD2E
SetKeyboardState.USER32(?), ref: 00FCAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00FCADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00FCADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00FCAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00FCAE38

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: c48587e52a3f95e71bbad0bfb6739f37b8679d19fe23c43cc08f163175572a9c
Instruction ID: ecf1101a801f22cd1d54dee1b4d93aa31cc4f7b12799a95bb34bcc892945079a
Opcode Fuzzy Hash: c48587e52a3f95e71bbad0bfb6739f37b8679d19fe23c43cc08f163175572a9c
Instruction Fuzzy Hash: BF51B4A19047DA3DFB3782258D57FBA7E985B45318F08848CE1D6468C3D294BC98F792

Function 00F9542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00FA3CD6,?,?,?,?,?,?,?,?,00F95BA3,?,?,00FA3CD6,?,?), ref: 00F95470
__fassign.LIBCMT ref: 00F954EB
__fassign.LIBCMT ref: 00F95506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00FA3CD6,00000005,00000000,00000000), ref: 00F9552C
WriteFile.KERNEL32(?,00FA3CD6,00000000,00F95BA3,00000000,?,?,?,?,?,?,?,?,?,00F95BA3,?), ref: 00F9554B
WriteFile.KERNEL32(?,?,00000001,00F95BA3,00000000,?,?,?,?,?,?,?,?,?,00F95BA3,?), ref: 00F95584

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: f5aba20b06ae88cf2e6545cf1fd9bdc64232b84934320e18f145d901574925a8
Instruction ID: f42813fa8d4a9e44037eff5fdce5038c625f754f55af8ea6a9392a2e889a2aa2
Opcode Fuzzy Hash: f5aba20b06ae88cf2e6545cf1fd9bdc64232b84934320e18f145d901574925a8
Instruction Fuzzy Hash: 1E51D3B1E006099FEF11CFA8D841AEEBBF9EF09710F19411AF555E7292D7309A41DBA0

Function 00F7912D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F79141
ScreenToClient.USER32(00000000,?), ref: 00F7915E
GetAsyncKeyState.USER32(00000001), ref: 00F79183
GetAsyncKeyState.USER32(00000002), ref: 00F7919D

Strings

InitializeCriticalSectionEx, xrefs: 00FB7152

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID: InitializeCriticalSectionEx
API String ID: 4210589936-3084827643
Opcode ID: 34d8b04417c1d0c6a544f5d765a6a285aab16e7b2f8a0dbab8709218abfdbed6
Instruction ID: e08d810122f05631b2fb075222cecf81b50b2a831ca811ce645b920fb7a32554
Opcode Fuzzy Hash: 34d8b04417c1d0c6a544f5d765a6a285aab16e7b2f8a0dbab8709218abfdbed6
Instruction Fuzzy Hash: 6841727190861ABBDF05AF68C844BFEB774FF45330F208216E429A72A0C7745954EFA1

Function 00F82D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F82D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00F82D53
_ValidateLocalCookies.LIBCMT ref: 00F82DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00F82E0C
_ValidateLocalCookies.LIBCMT ref: 00F82E61

Strings

csm, xrefs: 00F82DF6

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1eeb9b86613c8436772138732a2cdf35ac8f01d3ccf121da3ccd51794fcf4e90
Instruction ID: 65715233fb886b110021011b4b9c0f92db6f4a4dc5d3bdce2fa5c14868e91051
Opcode Fuzzy Hash: 1eeb9b86613c8436772138732a2cdf35ac8f01d3ccf121da3ccd51794fcf4e90
Instruction Fuzzy Hash: 6C419136E00209ABCF50EF68CC85ADEBFB5BF45364F148155E8186B392D735AA05EB90

Function 00FE10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FE307A
Part of subcall function 00FE304E: _wcslen.LIBCMT ref: 00FE309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00FE1112
WSAGetLastError.WSOCK32 ref: 00FE1121
WSAGetLastError.WSOCK32 ref: 00FE11C9
closesocket.WSOCK32(00000000), ref: 00FE11F9

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 6bd7cada5b33209d84c6e2d192c8d00eec11fa8d44fabd166c8393c2fa284d3a
Instruction ID: 238e318f445ba8423965c670c24e1b5a164d17d0a3fb63e7729ac95f50dad83b
Opcode Fuzzy Hash: 6bd7cada5b33209d84c6e2d192c8d00eec11fa8d44fabd166c8393c2fa284d3a
Instruction Fuzzy Hash: 31411232600258AFDB109F56CC84BAABBEDFF44364F148059F9469B291C778AD41DBE1

Function 00FCCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FCCF22,?), ref: 00FCDDFD

Part of subcall function 00FCDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FCCF22,?), ref: 00FCDE16

lstrcmpiW.KERNEL32(?,?), ref: 00FCCF45
MoveFileW.KERNEL32(?,?), ref: 00FCCF7F
_wcslen.LIBCMT ref: 00FCD005
_wcslen.LIBCMT ref: 00FCD01B
SHFileOperationW.SHELL32(?), ref: 00FCD061

Strings

\*.*, xrefs: 00FCCFF3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: d081faedbb58483f1ab272ce5d37e72c4492029c4c249121ea10bfba7a8c6861
Instruction ID: b0c2c7235751b1618b5786041328569505b7b6d664a6e32c9129273cec5d344d
Opcode Fuzzy Hash: d081faedbb58483f1ab272ce5d37e72c4492029c4c249121ea10bfba7a8c6861
Instruction Fuzzy Hash: F0413471D452195FDF12EBA4CE82FDDB7B9AF08380F1000EEE509EB141EA74A649EB50

Function 00FF2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00FF2E1C
GetWindowLongW.USER32(?,000000F0), ref: 00FF2E4F
GetWindowLongW.USER32(?,000000F0), ref: 00FF2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00FF2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00FF2EE0
GetWindowLongW.USER32(?,000000F0), ref: 00FF2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FF2F0B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 1066d79e7b0e369659d096864fe5e2e61f3e761cdd741a501eac4ad6e04ea702
Instruction ID: 069242fd0df45e93dcb85052696dc3de2e78bd02f75fca79f4762fd6e2ef7717
Opcode Fuzzy Hash: 1066d79e7b0e369659d096864fe5e2e61f3e761cdd741a501eac4ad6e04ea702
Instruction Fuzzy Hash: 1B31F231A44258AFEB618F58DD84F6537E9FF9A720F2501A5FA44CF2B1CB71A840EB41

Function 00FC7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FC7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FC778F
SysAllocString.OLEAUT32(00000000), ref: 00FC7792
SysAllocString.OLEAUT32(?), ref: 00FC77B0
SysFreeString.OLEAUT32(?), ref: 00FC77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00FC77DE
SysAllocString.OLEAUT32(?), ref: 00FC77EC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 931e0363255cbc7e9c983b7f9750069f3f3127212426c1eb25dc8805afd3172a
Instruction ID: d8067bcb98437914f587531b1b72d3774b698142c8c9a6d6098abbc4aa642cb2
Opcode Fuzzy Hash: 931e0363255cbc7e9c983b7f9750069f3f3127212426c1eb25dc8805afd3172a
Instruction Fuzzy Hash: 2A21B276A0421EAFDB10EFA8CD89EBB73ACEF093647008029F914DB150D674DC45EBA4

Function 00FC77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FC7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FC7868
SysAllocString.OLEAUT32(00000000), ref: 00FC786B
SysAllocString.OLEAUT32 ref: 00FC788C
SysFreeString.OLEAUT32 ref: 00FC7895
StringFromGUID2.OLE32(?,?,00000028), ref: 00FC78AF
SysAllocString.OLEAUT32(?), ref: 00FC78BD

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 0264d6b35bddd31effcfdc83f64139a57f7c82f6bb03537664cadd9e96da3475
Instruction ID: 817e30fd1cf1da6549acc36176e16e351a51b9d721e9bcb6515910d2a9125c23
Opcode Fuzzy Hash: 0264d6b35bddd31effcfdc83f64139a57f7c82f6bb03537664cadd9e96da3475
Instruction Fuzzy Hash: 1621A931604219AFDB10AFA8DD89E7A77ECEF083607108125FA15CB1E1D674DC41EB64

Function 00FD04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00FD04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FD052E

Strings

nul, xrefs: 00FD0567

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: ef5fd50603728be2f64590a1c0bb41e93ccec55062558a52370cb5557c885efa
Instruction ID: 9bf8200c4dcc5518b816ebd15966266ed9a6cc7bf269a72ec882ad2340bde0ea
Opcode Fuzzy Hash: ef5fd50603728be2f64590a1c0bb41e93ccec55062558a52370cb5557c885efa
Instruction Fuzzy Hash: 64218275900309DBDB209F29EC04B5A77A9AF44734F284A1AFCA1D73E0DB709940EF60

Function 00FD05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00FD05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FD0601

Strings

nul, xrefs: 00FD0639

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: e7274ca626b2c197dd22cda0132f427548129048e8a887680785c8870b509c62
Instruction ID: 4f3e706973488609a36aecb2700825ae33aa7d3953c0954951711dd4ba80b75c
Opcode Fuzzy Hash: e7274ca626b2c197dd22cda0132f427548129048e8a887680785c8870b509c62
Instruction Fuzzy Hash: 6D2156759003159BDB209F799C04B5A77E9AF95730F240A1AF8A1D73D0DB70D960EB50

Function 00FF40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F6600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F6604C
Part of subcall function 00F6600E: GetStockObject.GDI32(00000011), ref: 00F66060
Part of subcall function 00F6600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F6606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00FF4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00FF411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00FF412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00FF4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00FF4145

Strings

Msctls_Progress32, xrefs: 00FF40E3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: f3737dc24067101538461f316d8ba73a9a0d69d2a8ae3bb64e948e3a1869cdf3
Instruction ID: 4b2642c7965bd3eade45cfe6d91d1fae808ca443b585a99f85713b1236cb0be9
Opcode Fuzzy Hash: f3737dc24067101538461f316d8ba73a9a0d69d2a8ae3bb64e948e3a1869cdf3
Instruction Fuzzy Hash: B9118EB214021DBEEF118E64CC85EE77F5DEF087A8F004110BB18A6060CA769C21EBA4

Function 00F9D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F9D7A3: _free.LIBCMT ref: 00F9D7CC

_free.LIBCMT ref: 00F9D82D

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F9D838
_free.LIBCMT ref: 00F9D843
_free.LIBCMT ref: 00F9D897
_free.LIBCMT ref: 00F9D8A2
_free.LIBCMT ref: 00F9D8AD
_free.LIBCMT ref: 00F9D8B8

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 6b607e9e5b192af5f791aa4c17bb10002197de02a1e6b8fd8192342ed512f881
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: D6111F71540B04BAFEA5FFF0CC47FCB7BEC6F04700F504825B29DA6492DA69B50566A1

Function 00FCDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00FCDA74
LoadStringW.USER32(00000000), ref: 00FCDA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00FCDA91
LoadStringW.USER32(00000000), ref: 00FCDA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00FCDADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00FCDAB9

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 15a90699480a24cf3e445e9400ea257b6d235e597a1cfc199009063b44bb9753
Instruction ID: 8647a1d73bdc751ff750e9b145ce208b96b14f87dd00b856724db281967dbeac
Opcode Fuzzy Hash: 15a90699480a24cf3e445e9400ea257b6d235e597a1cfc199009063b44bb9753
Instruction Fuzzy Hash: 5C0167F250421C7FE710A7A09E89EFB726CDB04701F400455B745E2041E6749E849F74

Function 00FD096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(010DE620,010DE620), ref: 00FD097B
EnterCriticalSection.KERNEL32(010DE600,00000000), ref: 00FD098D
TerminateThread.KERNEL32(?,000001F6), ref: 00FD099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00FD09A9
CloseHandle.KERNEL32(?), ref: 00FD09B8
InterlockedExchange.KERNEL32(010DE620,000001F6), ref: 00FD09C8
LeaveCriticalSection.KERNEL32(010DE600), ref: 00FD09CF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 80a5d663a13f51ecb903b15eaeac67070a08a6ca3528d03f187bb8c62a11df5c
Instruction ID: 9d9d7786f8da84f9e79e2857443764d6f0c66b1693e388b9e37474a458c38714
Opcode Fuzzy Hash: 80a5d663a13f51ecb903b15eaeac67070a08a6ca3528d03f187bb8c62a11df5c
Instruction Fuzzy Hash: 99F01D3144252ABBD7415B94EF88BE67A39FF01712F441016F101918A0CB749465EFD0

Function 00F65D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00F65D30
GetWindowRect.USER32(?,?), ref: 00F65D71
ScreenToClient.USER32(?,?), ref: 00F65D99
GetClientRect.USER32(?,?), ref: 00F65ED7
GetWindowRect.USER32(?,?), ref: 00F65EF8

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 5c0725029d3ee7f9ddc1ea3171fb5e7ffb1efa17e5be0fa3501ab97da46d2b6b
Instruction ID: f1dd1cde41bc3b11bbae80c304b1a0e1faa74bb98a9f3329fafe8c28dc5499b2
Opcode Fuzzy Hash: 5c0725029d3ee7f9ddc1ea3171fb5e7ffb1efa17e5be0fa3501ab97da46d2b6b
Instruction Fuzzy Hash: A0B17875A00A4ADBDB10CFA8C5807EEB7F1FF58310F14841AE8A9E7250DB34AA51EB50

Function 00F901B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00F900BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F900D6
__allrem.LIBCMT ref: 00F900ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F9010B
__allrem.LIBCMT ref: 00F90122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F90140

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 025c4a11ffdf5fcc44af8b488434d9c490f944aa117acb6e0fc44fd4c4591ef7
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: E681F772E007069FFB24AF68CC42BAB73E9AF41734F24423AF551D6291EB74D944A750

Function 00FE1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00FE101C,00000000,?,?,00000000), ref: 00FE3195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00FE1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00FE1DE1
WSAGetLastError.WSOCK32 ref: 00FE1DF2
inet_ntoa.WSOCK32(?), ref: 00FE1E8C
htons.WSOCK32(?,?,?,?,?), ref: 00FE1EDB
_strlen.LIBCMT ref: 00FE1F35

Part of subcall function 00FC39E8: _strlen.LIBCMT ref: 00FC39F2

Part of subcall function 00F66D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00F7CF58,?,?,?), ref: 00F66DBA
Part of subcall function 00F66D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00F7CF58,?,?,?), ref: 00F66DED

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 3f53cabc504e8c73f2031bab3dbd3b45ed0de567fe62ec785b1f860b45de0175
Instruction ID: 847a83213653b1508204067dc3b8d294e083489c88f70874204bf75175ea78d5
Opcode Fuzzy Hash: 3f53cabc504e8c73f2031bab3dbd3b45ed0de567fe62ec785b1f860b45de0175
Instruction Fuzzy Hash: 6DA1E031604380AFC324DF26CC85F2A77A5BF84318F54894CF4569B2A2CB75ED46EB92

Function 00F961FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00F882D9,00F882D9,?,?,?,00F9644F,00000001,00000001,8BE85006), ref: 00F96258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00F9644F,00000001,00000001,8BE85006,?,?,?), ref: 00F962DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F963D8
__freea.LIBCMT ref: 00F963E5

Part of subcall function 00F93820: RtlAllocateHeap.NTDLL(00000000,?,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6,?,00F61129), ref: 00F93852

__freea.LIBCMT ref: 00F963EE
__freea.LIBCMT ref: 00F96413

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: a08b08c3446717a62585137c46f685262d5ebca1f5172fd4969e71c446a89d77
Instruction ID: 63d8240264d9848c9bd1a80580ab8822cb94b8e9cdba3671c3dd61904520edfb
Opcode Fuzzy Hash: a08b08c3446717a62585137c46f685262d5ebca1f5172fd4969e71c446a89d77
Instruction Fuzzy Hash: B151D172A00216ABFF268F64CC81EBF77A9EF44760F154629FC05D6240EB38DC50E6A0

Function 00FEBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FEB6AE,?,?), ref: 00FEC9B5
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FEC9F1
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA68
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FEBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FEBD25
RegCloseKey.ADVAPI32(00000000), ref: 00FEBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00FEBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00FEBDF3
RegCloseKey.ADVAPI32(?), ref: 00FEBDFF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 0d4b18f7e67f028a1431600a0a39e7ff6951d3a41e372e0715fa8787256f0468
Instruction ID: 24e295932a58999abb115766ebeda6eba5b2a54f523be855e64a501d94c1b94b
Opcode Fuzzy Hash: 0d4b18f7e67f028a1431600a0a39e7ff6951d3a41e372e0715fa8787256f0468
Instruction Fuzzy Hash: 30819E31508281AFD714DF24C885E2BBBE9FF84318F14855CF4598B2A2DB35ED45EB92

Function 00FBF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00FBF7B9
SysAllocString.OLEAUT32(00000001), ref: 00FBF860
VariantCopy.OLEAUT32(00FBFA64,00000000), ref: 00FBF889
VariantClear.OLEAUT32(00FBFA64), ref: 00FBF8AD
VariantCopy.OLEAUT32(00FBFA64,00000000), ref: 00FBF8B1
VariantClear.OLEAUT32(?), ref: 00FBF8BB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 7849b6a611dd857fefc5d77537ac81964fb34de2f30e626f4984e607e68c47d8
Instruction ID: e351cafcbeef2d21d650258301da1010d3203617c7cca3fe618a425761bb1757
Opcode Fuzzy Hash: 7849b6a611dd857fefc5d77537ac81964fb34de2f30e626f4984e607e68c47d8
Instruction Fuzzy Hash: 3E510931600314BACF20AB66DC95BA9B3A8EF45310F248477E805DF291DB748C48FF96

Function 00FD910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00F67620: _wcslen.LIBCMT ref: 00F67625

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00FD94E5
_wcslen.LIBCMT ref: 00FD9506
_wcslen.LIBCMT ref: 00FD952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00FD9585

Strings

X, xrefs: 00FD9412

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 79e85516dc7b4498e00c9de0b9716bd578e5d530978f9a6cc45d798104a6afe2
Instruction ID: 50a40a1a49b31a0572fe0967f8b00a97491756c4c2f28cc94be5afba232f9356
Opcode Fuzzy Hash: 79e85516dc7b4498e00c9de0b9716bd578e5d530978f9a6cc45d798104a6afe2
Instruction Fuzzy Hash: 28E1A5319083008FD724EF64C881B6AB7E5BF85314F18856EF8899B3A2DB75DD05EB91

Function 00F7920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

BeginPaint.USER32(?,?,?), ref: 00F79241
GetWindowRect.USER32(?,?), ref: 00F792A5
ScreenToClient.USER32(?,?), ref: 00F792C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00F792D3
EndPaint.USER32(?,?,?,?,?), ref: 00F79321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00FB71EA

Part of subcall function 00F79339: BeginPath.GDI32(00000000), ref: 00F79357

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 6e46b9b860abe2a85a0eeb51f7f64a0501427535aeaa960c40df6887fd97bb00
Instruction ID: 6ef6ce6cdab0445e609a0e37b4c34db13eb52d2636478200b5a41847c97fa959
Opcode Fuzzy Hash: 6e46b9b860abe2a85a0eeb51f7f64a0501427535aeaa960c40df6887fd97bb00
Instruction Fuzzy Hash: 4941A231508305AFD720EF25CC84FB67BACEF89320F14426AF999872E1C7759845EB62

Function 00FD07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00FD080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00FD0847
EnterCriticalSection.KERNEL32(?), ref: 00FD0863
LeaveCriticalSection.KERNEL32(?), ref: 00FD08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00FD08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00FD0921

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 65c95ef76d5b71dc42c8fc05151cd4c133ddd78a8cda077ddb9a96bd7a2e0c67
Instruction ID: d072aa290754848597f80daedde096443aa9a7bca1aed582313e2182d0cfb355
Opcode Fuzzy Hash: 65c95ef76d5b71dc42c8fc05151cd4c133ddd78a8cda077ddb9a96bd7a2e0c67
Instruction Fuzzy Hash: BB416D71900209EFDF14AF54DC85AAA77B9FF04310F1480A6ED049E297DB34DE64EBA5

Function 00FF81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00FBF3AB,00000000,?,?,00000000,?,00FB682C,00000004,00000000,00000000), ref: 00FF824C
EnableWindow.USER32(?,00000000), ref: 00FF8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00FF82D1
ShowWindow.USER32(?,00000004), ref: 00FF82E5
EnableWindow.USER32(?,00000001), ref: 00FF830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00FF832F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: c1d8e19750d5880c896bf0fe746d1cca71177a06c46759e1be66dc9540d883dd
Instruction ID: d849925bf05c6bfe9286251b3541e677a533a0ac57cbe2efab775624fe32a911
Opcode Fuzzy Hash: c1d8e19750d5880c896bf0fe746d1cca71177a06c46759e1be66dc9540d883dd
Instruction Fuzzy Hash: FE418634A0164CEFDB21CF15C985BF87BE4BF0A764F184165E6484B272CB32A846DF50

Function 00FC4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00FC4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00FC4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00FC4CEA
_wcslen.LIBCMT ref: 00FC4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00FC4D10
_wcsstr.LIBVCRUNTIME ref: 00FC4D1A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 55879a760d0f1f72c7a063fa23eaa68b0b38a64153186ffa202b9f8f9c909cc6
Instruction ID: 264ea9e9e16fc008ed447c5a57a18f1ca98f7fa3b5f95d4523e7632c30e6b162
Opcode Fuzzy Hash: 55879a760d0f1f72c7a063fa23eaa68b0b38a64153186ffa202b9f8f9c909cc6
Instruction Fuzzy Hash: 3521FC326041157BEB15AB35ED5AF7B7B9CDF45760F10802EF809CA191EA65EC00F7A0

Function 00FD581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F63A97,?,?,00F62E7F,?,?,?,00000000), ref: 00F63AC2

_wcslen.LIBCMT ref: 00FD587B
CoInitialize.OLE32(00000000), ref: 00FD5995
CoCreateInstance.OLE32(00FFFCF8,00000000,00000001,00FFFB68,?), ref: 00FD59AE
CoUninitialize.OLE32 ref: 00FD59CC

Strings

.lnk, xrefs: 00FD5876, 00FD58C1, 00FD5985

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: a799545e297e4a2dc63b1d74d77f6caf5265a5249d475f5cfa937dadea235e29
Instruction ID: a14298076035ad699f19d11aa8cdd90014cb071adf57ef130bffd633487f9fb7
Opcode Fuzzy Hash: a799545e297e4a2dc63b1d74d77f6caf5265a5249d475f5cfa937dadea235e29
Instruction Fuzzy Hash: 6AD15771A047019FC714DF14C89092ABBE6FF89B24F18485EF88A9B361DB35EC45DB92

Function 00FC175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FC0FCA
Part of subcall function 00FC0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FC0FD6
Part of subcall function 00FC0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FC0FE5
Part of subcall function 00FC0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FC0FEC
Part of subcall function 00FC0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FC1002

GetLengthSid.ADVAPI32(?,00000000,00FC1335), ref: 00FC17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00FC17BA
HeapAlloc.KERNEL32(00000000), ref: 00FC17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00FC17DA
GetProcessHeap.KERNEL32(00000000,00000000,00FC1335), ref: 00FC17EE
HeapFree.KERNEL32(00000000), ref: 00FC17F5

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: a6f43d668a71a46fa73e1ffab73a18558c808ae888ad48bd60a5211f75a1e82c
Instruction ID: 48fc2b1116bf250b681b5a5f5dc819ab300033e7787b75b00946ad68e1aea1a4
Opcode Fuzzy Hash: a6f43d668a71a46fa73e1ffab73a18558c808ae888ad48bd60a5211f75a1e82c
Instruction Fuzzy Hash: 4D118C3190020AEFDB109BA4CE4AFAF7BA9FF42365F10401CE44197212C7399965EBA0

Function 00FC14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00FC14FF
OpenProcessToken.ADVAPI32(00000000), ref: 00FC1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00FC1515
CloseHandle.KERNEL32(00000004), ref: 00FC1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FC154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00FC1563

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: ddbbbb9126268609dadfc50bd274934cac17e9f473f9ecb53a154871d71d7dba
Instruction ID: a772246a61ceb5353f618943799fe3a02f8d247e675a9e26214cec92ec761cd6
Opcode Fuzzy Hash: ddbbbb9126268609dadfc50bd274934cac17e9f473f9ecb53a154871d71d7dba
Instruction Fuzzy Hash: 39114A7250020EABDF11CF94DE49FEA7BADFF49754F044018FA05A2160C3718E65EB60

Function 00F83382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F83379,00F82FE5), ref: 00F83390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F8339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F833B7
SetLastError.KERNEL32(00000000,?,00F83379,00F82FE5), ref: 00F83409

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ab787ed178c81f449294312c670c32c834b5520c0a2d1d957dd4b7e45a2c023a
Instruction ID: 2567a7ebd9d2ceb98391f54446b443d1d5f2450d6efb27699c1f19baf2af3788
Opcode Fuzzy Hash: ab787ed178c81f449294312c670c32c834b5520c0a2d1d957dd4b7e45a2c023a
Instruction Fuzzy Hash: 3601B533A093117EAB353A786DC9EEA3A94EB06B757300229F810811F5EF1A4D01B785

Function 00F92D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F95686,00FA3CD6,?,00000000,?,00F95B6A,?,?,?,?,?,00F8E6D1,?,01028A48), ref: 00F92D78
_free.LIBCMT ref: 00F92DAB
_free.LIBCMT ref: 00F92DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00F8E6D1,?,01028A48,00000010,00F64F4A,?,?,00000000,00FA3CD6), ref: 00F92DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00F8E6D1,?,01028A48,00000010,00F64F4A,?,?,00000000,00FA3CD6), ref: 00F92DEC
_abort.LIBCMT ref: 00F92DF2

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: fa97a81f92074271216184cab20deb8bc983b13144f6789fbfb5ed56294e8a8f
Instruction ID: d0b6ba6a29bed06cb61df4da0ba37e5182a2ec27391e4ae3cdb930f37ddd0d15
Opcode Fuzzy Hash: fa97a81f92074271216184cab20deb8bc983b13144f6789fbfb5ed56294e8a8f
Instruction Fuzzy Hash: 25F0CD3690551437FFA277397D06E1F35596FC27B1F35041AF528D2195DE28880171A0

Function 00FF8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00F79639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F79693
Part of subcall function 00F79639: SelectObject.GDI32(?,00000000), ref: 00F796A2
Part of subcall function 00F79639: BeginPath.GDI32(?), ref: 00F796B9
Part of subcall function 00F79639: SelectObject.GDI32(?,00000000), ref: 00F796E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00FF8A4E
LineTo.GDI32(?,00000003,00000000), ref: 00FF8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00FF8A70
LineTo.GDI32(?,00000000,00000003), ref: 00FF8A80
EndPath.GDI32(?), ref: 00FF8A90
StrokePath.GDI32(?), ref: 00FF8AA0

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: c20232adb8db14dea660f43316188df2e049305018f3615fa3ee7265138395bc
Instruction ID: 99a2b675b0b9b08edd2d8adab1ea85d61b6385059e37b061fb5d76a9e8361454
Opcode Fuzzy Hash: c20232adb8db14dea660f43316188df2e049305018f3615fa3ee7265138395bc
Instruction Fuzzy Hash: C5111E7600011DFFDF119F90DC88EAA7F6CEF08364F008012BA1995161C7719D56EFA0

Function 00FC51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FC5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00FC5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FC5230
ReleaseDC.USER32(00000000,00000000), ref: 00FC5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00FC524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00FC5261

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 5371e6892b630ca6058d9390e25466955411f10672e354efd0fe7793996941ab
Instruction ID: 67e79ed47097b628d6cc86160c2d37f4ef8e91a287a733c19cfc7118c300b73f
Opcode Fuzzy Hash: 5371e6892b630ca6058d9390e25466955411f10672e354efd0fe7793996941ab
Instruction Fuzzy Hash: A6017C75E00619BBEB109BA69D49E9EBFA8EF48751F044065EA08E7280DA709804DBA0

Function 00F61BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F61BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00F61BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F61C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F61C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00F61C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F61C22

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 652dec401f0db07f75a95d46f95b2e9d21e9e6e5aac264d0dd806d7668532036
Instruction ID: e5ef5a84a8b8814677d3b26d863776beab73840c5ed32e7617a490bd88034243
Opcode Fuzzy Hash: 652dec401f0db07f75a95d46f95b2e9d21e9e6e5aac264d0dd806d7668532036
Instruction Fuzzy Hash: E9016CB090275D7DE3008F5A8C85B52FFA8FF19354F00411B915C47941C7F5A864CBE5

Function 00FCEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00FCEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00FCEB46
GetWindowThreadProcessId.USER32(?,?), ref: 00FCEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FCEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FCEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FCEB75

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: eecf0814da49093d97149cacf8b718f34aa2d3c7f0ee4c409873214d738a377a
Instruction ID: d4fa63eb9a158e65c396b1dcbc008b20d2b4f66af2b757e55d188f5cbe79e26c
Opcode Fuzzy Hash: eecf0814da49093d97149cacf8b718f34aa2d3c7f0ee4c409873214d738a377a
Instruction Fuzzy Hash: 82F03A7264016CBBE7215B629E0EEFF3A7CEFCAB11F000158F601D1091DBA05A11EAF5

Function 00FB7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00FB7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00FB7469
GetWindowDC.USER32(?), ref: 00FB7475
GetPixel.GDI32(00000000,?,?), ref: 00FB7484
ReleaseDC.USER32(?,00000000), ref: 00FB7496
GetSysColor.USER32(00000005), ref: 00FB74B0

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: fb8f4a9f7c300a0e32a5dc7adc17d32a296353905350d61eb6b3f88ae3a3aea3
Instruction ID: 737eaef56eae0d4414eee91121050aa137bc8faf6749ab2eeee60c347f9a28c6
Opcode Fuzzy Hash: fb8f4a9f7c300a0e32a5dc7adc17d32a296353905350d61eb6b3f88ae3a3aea3
Instruction Fuzzy Hash: 45015632404229EFDB10AF64DD08BFA7BB9FF04322F644060F919A21A0CB311E51FB91

Function 00FC1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00FC187F
UnloadUserProfile.USERENV(?,?), ref: 00FC188B
CloseHandle.KERNEL32(?), ref: 00FC1894
CloseHandle.KERNEL32(?), ref: 00FC189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00FC18A5
HeapFree.KERNEL32(00000000), ref: 00FC18AC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: b69fb01ac30638241f5c0213b3d630e30b7565f6e486c4c8f3a3f9aaed624a78
Instruction ID: 00311b11060747181e082f542e6c5746edbab38a19ab07dba0dda915c839031b
Opcode Fuzzy Hash: b69fb01ac30638241f5c0213b3d630e30b7565f6e486c4c8f3a3f9aaed624a78
Instruction Fuzzy Hash: 09E0C23600411DBBEA016BA2EE0CD1ABF2DFF49B22B108220F22581071CB329430FB90

Function 00FCC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67620: _wcslen.LIBCMT ref: 00F67625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FCC6EE
_wcslen.LIBCMT ref: 00FCC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FCC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00FCC7CA

Strings

0, xrefs: 00FCC6AF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 9fef2d2568e0136e28512452240d5f7ada58bf8c7098de22e0fd82bf7ea29c5e
Instruction ID: 18d310e88bb15fc6fbe2d896c8713e70fc75059ae801a71cf73a8b6e59c57f00
Opcode Fuzzy Hash: 9fef2d2568e0136e28512452240d5f7ada58bf8c7098de22e0fd82bf7ea29c5e
Instruction Fuzzy Hash: 1F519071A143029BD7149E28CA46F6B77E8EF89320F040A2DF999D2191DB74D904FB92

Function 00FEAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00FEAEA3

Part of subcall function 00F67620: _wcslen.LIBCMT ref: 00F67625

GetProcessId.KERNEL32(00000000), ref: 00FEAF38
CloseHandle.KERNEL32(00000000), ref: 00FEAF67

Strings

@, xrefs: 00FEAE72
<, xrefs: 00FEAE6B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 03bb81d0c901408805ba696104a32901ccbc56568b07ba04e365ab11da95a28a
Instruction ID: 655176e8c0fcb291ba1a6d756d9556b663d8dd81485f57fcffcd38f593208e96
Opcode Fuzzy Hash: 03bb81d0c901408805ba696104a32901ccbc56568b07ba04e365ab11da95a28a
Instruction Fuzzy Hash: 8671AC70A00658DFCB14EF65C884A9EBBF4FF08314F048499E856AB392C778ED45EB91

Function 00FC719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00FC7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00FC723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00FC724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00FC72CF

Strings

DllGetClassObject, xrefs: 00FC7242

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 70e3c2ad5c87d5cb46b0ea27fc53f5af203fa2c074680c0bdaa2d27d010f8bc9
Instruction ID: 239f662860cf7da44e7c51babf20471c86e37c2756c4d3bad71c3c8608d59aca
Opcode Fuzzy Hash: 70e3c2ad5c87d5cb46b0ea27fc53f5af203fa2c074680c0bdaa2d27d010f8bc9
Instruction Fuzzy Hash: A1418D71A043059FDB15DF54CA85F9A7BA9EF44310B1080ADBD059F20AD7B1D944EFA0

Function 00FF3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FF3E35
IsMenu.USER32(?), ref: 00FF3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FF3E92
DrawMenuBar.USER32 ref: 00FF3EA5

Strings

0, xrefs: 00FF3D89

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 4adac70304a023ef91235775bfc731cc018e9fd5173af1ef32259c13d2d7e027
Instruction ID: 21bce8d8e7fabb864771ab6f60aac757cebf0986f728f92c0daac6251479ddb7
Opcode Fuzzy Hash: 4adac70304a023ef91235775bfc731cc018e9fd5173af1ef32259c13d2d7e027
Instruction Fuzzy Hash: 13414775A0020DEFDF10DF50D884AEABBB9FF48364F044169EA15A7260D734AE49EF90

Function 00FC1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00FC1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00FC1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00FC1EA9

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

Strings

ComboBox, xrefs: 00FC1DF0
ListBox, xrefs: 00FC1E25

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: fc8e90d63529bf87b090ce57fe21ef95916f7bda0bd4c00530aab11e9218b566
Instruction ID: 6b44213542220d534aa094a2bd8e074aff6254a565abaa805c60658699be108d
Opcode Fuzzy Hash: fc8e90d63529bf87b090ce57fe21ef95916f7bda0bd4c00530aab11e9218b566
Instruction Fuzzy Hash: 9F210A71A00109BADB14AB64DE46DFF77BCEF46360B10411DF815E71E2DB785919F620

Function 00FEC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FEC9F1
_wcslen.LIBCMT ref: 00FECA68
_wcslen.LIBCMT ref: 00FECA9E
_wcslen.LIBCMT ref: 00FECAF9
_wcslen.LIBCMT ref: 00FECB2F
_wcslen.LIBCMT ref: 00FECB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 00FECA62, 00FECA67
HKLM, xrefs: 00FECA98, 00FECA9D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: e29882a9496e3690e1d49d370415e3791b8b554186e4abf79f36c76f9fcd6671
Instruction ID: 10281bdfbe54ecbcd280c213fa8f29398b2d6a5e94395fbd97149a22345214e3
Opcode Fuzzy Hash: e29882a9496e3690e1d49d370415e3791b8b554186e4abf79f36c76f9fcd6671
Instruction Fuzzy Hash: 7C31E973E001EA4BCB30EE6ED9605BE33919BA1F64B154039F855AB245E679CD42B3E0

Function 00FF2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00FF2F8D
LoadLibraryW.KERNEL32(?), ref: 00FF2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00FF2FA9
DestroyWindow.USER32(?), ref: 00FF2FB1

Strings

SysAnimate32, xrefs: 00FF2F68

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: f673eed1e9ffaff3f9d86aadd81dcc38b943f4adf9874a40969f59e31417a9b2
Instruction ID: cd405a177d82575fc87f2ef51e50c852a131699743b6042c5b5eb9a851df16ae
Opcode Fuzzy Hash: f673eed1e9ffaff3f9d86aadd81dcc38b943f4adf9874a40969f59e31417a9b2
Instruction Fuzzy Hash: 16216572A24209ABEB504EA49C80ABA36A9EF59374F104628FA50D61E0D771DC51A7A0

Function 00F84D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00F84D1E,00F928E9,?,00F84CBE,00F928E9,010288B8,0000000C,00F84E15,00F928E9,00000002), ref: 00F84D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F84DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00F84D1E,00F928E9,?,00F84CBE,00F928E9,010288B8,0000000C,00F84E15,00F928E9,00000002,00000000), ref: 00F84DC3

Strings

mscoree.dll, xrefs: 00F84D86
CorExitProcess, xrefs: 00F84D98

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2575c457b8d5b715b7836961ab9c48bb2009db245fd074fa231c8d4f73b3dd96
Instruction ID: 1339b5497f91413677da7e8fc7252b068dc9b63feb4542b2dae7ccd6e254548b
Opcode Fuzzy Hash: 2575c457b8d5b715b7836961ab9c48bb2009db245fd074fa231c8d4f73b3dd96
Instruction Fuzzy Hash: 83F0AF31A0021DBBEB11AF90DD49BEDBBB9EF04752F0000A8F809A2650CB345940EBD0

Function 00FBD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00FBD3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00FBD3BF
FreeLibrary.KERNEL32(00000000), ref: 00FBD3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00FBD3B9
X64, xrefs: 00FBD2A8

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 57402496f6ea777a37a4e25fca5ccab999e6558869db71cee860d963aee30ede
Instruction ID: a8c7f3663af232601aa778b913a79780162d72ce5f0a721bada19fa6dbba301b
Opcode Fuzzy Hash: 57402496f6ea777a37a4e25fca5ccab999e6558869db71cee860d963aee30ede
Instruction Fuzzy Hash: CCF0E5368016799BD7351B12CC58AF97368AF10745B59916AF806E6116FB30CD44FEC3

Function 00F64E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F64EDD,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F64EAE
FreeLibrary.KERNEL32(00000000,?,?,00F64EDD,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00F64EA8
kernel32.dll, xrefs: 00F64E94

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: a6ced31fa81ec2da4644aa0a0c88810a476ee004d20a2bac3d19e276943a0d1a
Instruction ID: de1a44461aa88943628b9de46501ad2e35aa44a2f1f88ec0c1c2a1b48710c200
Opcode Fuzzy Hash: a6ced31fa81ec2da4644aa0a0c88810a476ee004d20a2bac3d19e276943a0d1a
Instruction Fuzzy Hash: F7E08C36E0263A5B92222B25AD18A7BB668AF92B76B050115FD04E2210DB64DC01A0E1

Function 00F64E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00FA3CDE,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F64E74
FreeLibrary.KERNEL32(00000000,?,?,00FA3CDE,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00F64E6E
kernel32.dll, xrefs: 00F64E5B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 94ffae587b82089ef4e3b38de4700d83673ad26730a418ebca08ca50f856b331
Instruction ID: 08ed3e625e25b4d3a1a761b1ec01ecc1c6899a16df6c5dccf15ed369933aba02
Opcode Fuzzy Hash: 94ffae587b82089ef4e3b38de4700d83673ad26730a418ebca08ca50f856b331
Instruction Fuzzy Hash: D4D0C23990263A5B46222B256C08EAB3A1CAF85B253050116F904A6110CF21CD11E1D0

Function 00FD2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FD2C05
DeleteFileW.KERNEL32(?), ref: 00FD2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00FD2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FD2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FD2CC0

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: b44f2a1e49d35d8066ce5886d8b3ff0460e5efc47e839edd1ae2caacfdd1051a
Instruction ID: abf26eb20a5cb80506475cfce49731d4ea4850b490b290c1e1816bc1b7a14474
Opcode Fuzzy Hash: b44f2a1e49d35d8066ce5886d8b3ff0460e5efc47e839edd1ae2caacfdd1051a
Instruction Fuzzy Hash: DCB15E72D0012DABDF21EBA4CC85EDEB77DEF58310F1440A6F509E7241EA349A44AFA1

Function 00FEA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00FEA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00FEA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00FEA468
CloseHandle.KERNEL32(?), ref: 00FEA63D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: f0599a2ecdca430ac12af3107d16bf6e72ce7439248f215ac853d9925d6e1536
Instruction ID: 3aebc039f483b4366dadaf4dcdc108789830f82f1d20107cb07f1467b236f2c1
Opcode Fuzzy Hash: f0599a2ecdca430ac12af3107d16bf6e72ce7439248f215ac853d9925d6e1536
Instruction Fuzzy Hash: FFA19F716043009FD720DF25C886F2AB7E5AF84714F18885DF59ADB292DBB4EC41DB92

Function 00FCE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FCCF22,?), ref: 00FCDDFD

Part of subcall function 00FCDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FCCF22,?), ref: 00FCDE16

Part of subcall function 00FCE199: GetFileAttributesW.KERNEL32(?,00FCCF95), ref: 00FCE19A

lstrcmpiW.KERNEL32(?,?), ref: 00FCE473
MoveFileW.KERNEL32(?,?), ref: 00FCE4AC
_wcslen.LIBCMT ref: 00FCE5EB
_wcslen.LIBCMT ref: 00FCE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00FCE650

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 7539393ee8ed7d1015ad78e9310e6c414db50a026ddc0bc2c326ba79a57c6e2f
Instruction ID: 804ff16a8d9a0313c1720f422bf812d70dbb1b7f56197be46b58c07d4c9f8aaa
Opcode Fuzzy Hash: 7539393ee8ed7d1015ad78e9310e6c414db50a026ddc0bc2c326ba79a57c6e2f
Instruction Fuzzy Hash: EF5183B24087465BC724EBA0CD82EDF73DCAF85350F00491EF689D3191EF78A588A766

Function 00FEB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FEB6AE,?,?), ref: 00FEC9B5
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FEC9F1
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA68
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FEBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FEBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00FEBB63
RegCloseKey.ADVAPI32(?,?), ref: 00FEBBA6
RegCloseKey.ADVAPI32(00000000), ref: 00FEBBB3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6bb9e10bbaf43beada2a49784110f8a926d6bec44dc13b14f7010c8b58739b2b
Instruction ID: f21a913f2f620e4bf374f8f538a522377c7b8fa1844dda0c4ebe1533e836ef77
Opcode Fuzzy Hash: 6bb9e10bbaf43beada2a49784110f8a926d6bec44dc13b14f7010c8b58739b2b
Instruction Fuzzy Hash: 5161D431508241AFD714DF14C890E2BBBE9FF84318F14856CF4998B2A2CB35ED45EB92

Function 00FC8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FC8BCD
VariantClear.OLEAUT32 ref: 00FC8C3E
VariantClear.OLEAUT32 ref: 00FC8C9D
VariantClear.OLEAUT32(?), ref: 00FC8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00FC8D3B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 29b0feb30b91cc550fb171ff840ae14a373f09f6104a597118f7fb04956ac046
Instruction ID: 646a368841f73a7aaceee29053d404840b6fa5c9bd6a43b150e8b048619e66ed
Opcode Fuzzy Hash: 29b0feb30b91cc550fb171ff840ae14a373f09f6104a597118f7fb04956ac046
Instruction Fuzzy Hash: C9515BB5A0021AEFCB14CF58D894EAAB7F8FF89350B158559E906DB350E730E912CB90

Function 00FD8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00FD8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00FD8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00FD8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00FD8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00FD8C5F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 4807724eae65f3f93b17417bc10ad887f804a310dfdf91a5a14cc5dee5dfcff8
Instruction ID: 6d21ebb02effba08e4d9c14b1e0ef2fa894a6db08579c29060f6b23cb97787c0
Opcode Fuzzy Hash: 4807724eae65f3f93b17417bc10ad887f804a310dfdf91a5a14cc5dee5dfcff8
Instruction Fuzzy Hash: 4F514A35A00219DFCB05DF64C881A6DBBF5FF48314F088499E84AAB362DB35ED51EB90

Function 00FE8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00FE8F40
GetProcAddress.KERNEL32(00000000,?), ref: 00FE8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00FE8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00FE9032
FreeLibrary.KERNEL32(00000000), ref: 00FE9052

Part of subcall function 00F7F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00FD1043,?,753CE610), ref: 00F7F6E6
Part of subcall function 00F7F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00FBFA64,00000000,00000000,?,?,00FD1043,?,753CE610,?,00FBFA64), ref: 00F7F70D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 22b8c8f624a55bcc6d73f2a18bbe4650fecf1119ba1ac8c9d3e43386e43b04e6
Instruction ID: 002c12a6339b2217ea7760a8784d1455aed36824cdf96fb37dc8403c1287d85b
Opcode Fuzzy Hash: 22b8c8f624a55bcc6d73f2a18bbe4650fecf1119ba1ac8c9d3e43386e43b04e6
Instruction Fuzzy Hash: 69516F35A04245DFC710EF65C4848ADBBF1FF49324F488099E80A9B362DB75ED86EB90

Function 00FF6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00FF6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00FF6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00FF6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00FDAB79,00000000,00000000), ref: 00FF6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00FF6CC7

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: c42b95d469a185b1d7161d8d106143a9462e6763282533c4a769d841df71e64d
Instruction ID: 73153308f42467bc7d78cac1888bc0bfeb2ab78480748134ae956e8212a4200e
Opcode Fuzzy Hash: c42b95d469a185b1d7161d8d106143a9462e6763282533c4a769d841df71e64d
Instruction Fuzzy Hash: A441B235A0411CAFD7248F28CD54BB57BA8EF09360F150264EA95E73B1CB71AD41EA80

Function 00F92051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F920C3
_free.LIBCMT ref: 00F920E3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 7849962b7669997d64fe950c9e6898c489b0d9b0df0a16a05232f8831548823b
Instruction ID: 7a6c7922ba9ef732b5f03d2141e5b2d845ae205b8c8480a4185d4d885c6960d2
Opcode Fuzzy Hash: 7849962b7669997d64fe950c9e6898c489b0d9b0df0a16a05232f8831548823b
Instruction Fuzzy Hash: AD41E232E00200AFEF24DF78C880A5DB7B5EF89320F154569E519EB351DB35AD01EB81

Function 00FD3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00FD38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00FD3922
TranslateMessage.USER32(?), ref: 00FD394B
DispatchMessageW.USER32(?), ref: 00FD3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FD3966

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: e176603cafebf5f19df35b1a14e23526c51ceb482bd91069b1cfcef3b142601e
Instruction ID: 5e6f05814cc2af6455080348757917e8759c59ce34904960f22e38f0e92fe0cf
Opcode Fuzzy Hash: e176603cafebf5f19df35b1a14e23526c51ceb482bd91069b1cfcef3b142601e
Instruction Fuzzy Hash: FE31C871D04345AEEB35CB349858BB637AEAB05310F0C456BE6A2822D0D3F99684FB53

Function 00FDCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00FDCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00FDCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00FDC21E,00000000), ref: 00FDCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00FDC21E,00000000), ref: 00FDCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00FDC21E,00000000), ref: 00FDCFF2

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 61b72ba22dc2794e7185816f56da3f8257582fa114a07e8fd19d136c6bb39411
Instruction ID: 010eb68fa39bc79ee6f4ef8176424ae552c8d5e628cb2d1197db57136ab0c0b0
Opcode Fuzzy Hash: 61b72ba22dc2794e7185816f56da3f8257582fa114a07e8fd19d136c6bb39411
Instruction Fuzzy Hash: D131417290420AAFDB20DFA5C984AABBBFEEF14351B14442FF516D2250D730AD45EBB0

Function 00FC1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FC1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00FC19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00FC19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00FC19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00FC19E2

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 881cb75f1eceabd1a66f6395a3b8744271165de324d4e3273ac0b349a1761c01
Instruction ID: 31a331f510fb89f016374180a0e2c4d9c122ead1f393017734dc11fd2994aebb
Opcode Fuzzy Hash: 881cb75f1eceabd1a66f6395a3b8744271165de324d4e3273ac0b349a1761c01
Instruction Fuzzy Hash: 9031927190021EEFCB10CF68CA59BAE7BB5FF45315F104219F925A72D1C7709954EB90

Function 00FF5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00FF5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00FF579D
_wcslen.LIBCMT ref: 00FF57AF
_wcslen.LIBCMT ref: 00FF57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00FF5816

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 8d8f1d70629260ab015d8e717c6161861bcba53704ea6541e690509c65679ebe
Instruction ID: 3708333afe1362c08e2af9494fa816bed305ea7821ad531e975b848a35039dbf
Opcode Fuzzy Hash: 8d8f1d70629260ab015d8e717c6161861bcba53704ea6541e690509c65679ebe
Instruction Fuzzy Hash: C7216171D0461C9ADB209FA0CC85AFDB7B8FF04B24F108256EB19EA190D7749985DF50

Function 00FE0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00FE0951
GetForegroundWindow.USER32 ref: 00FE0968
GetDC.USER32(00000000), ref: 00FE09A4
GetPixel.GDI32(00000000,?,00000003), ref: 00FE09B0
ReleaseDC.USER32(00000000,00000003), ref: 00FE09E8

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: a603d73602882ea0ec3ec4b73a7ed0bfe913831d9024259878ae62f9d022bd6b
Instruction ID: 699dcd5b4a87d4300a5f1a939dbf077971e9a4572f7201f83986f015e98578b0
Opcode Fuzzy Hash: a603d73602882ea0ec3ec4b73a7ed0bfe913831d9024259878ae62f9d022bd6b
Instruction Fuzzy Hash: 1D218135600218AFD714EF65DD84AAEBBE9EF44700F048469F84AE7362DB74AC44EB90

Function 00F9CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00F9CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F9CDE9

Part of subcall function 00F93820: RtlAllocateHeap.NTDLL(00000000,?,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6,?,00F61129), ref: 00F93852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F9CE0F
_free.LIBCMT ref: 00F9CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F9CE31

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: e9cfd90485124a4ded043bbf4f9a2cf374d6fa8ca1ffab0a8a9045d3de1ec23a
Instruction ID: 4f322a9c7773e12a73a7f2239b5f1b1018d250520eb116748797644d090f571f
Opcode Fuzzy Hash: e9cfd90485124a4ded043bbf4f9a2cf374d6fa8ca1ffab0a8a9045d3de1ec23a
Instruction Fuzzy Hash: 65018472A012297F3B2166BA6C88D7B796DDEC6BA1315012AF906C7201EA658D01F2F0

Function 00F79639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F79693
SelectObject.GDI32(?,00000000), ref: 00F796A2
BeginPath.GDI32(?), ref: 00F796B9
SelectObject.GDI32(?,00000000), ref: 00F796E2

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 75a18366e1fd5bff81410ffaeb21d3455bcd5abf2b24c8e45738abded9b464eb
Instruction ID: 1de4c6ce0a6ba6d82183d8bf5b7502f75d2a574459671dc28da644bd1780ed29
Opcode Fuzzy Hash: 75a18366e1fd5bff81410ffaeb21d3455bcd5abf2b24c8e45738abded9b464eb
Instruction Fuzzy Hash: DD218031816309EBDB219F24DD04BA93BACBB44735F108317F454A61E4D3BA9891EF95

Function 00FC5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00FC5726
_memcmp.LIBVCRUNTIME ref: 00FC5744
_memcmp.LIBVCRUNTIME ref: 00FC5757
_memcmp.LIBVCRUNTIME ref: 00FC576F
_memcmp.LIBVCRUNTIME ref: 00FC5787

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: e3499d07af07b3b1d19f954717213085031508bb009330ed3fd82e18d3cb0b96
Instruction ID: fd06cd2903d610db193c3d3a5ca4f725c8d36865b102aac20d5062fd5b7333fe
Opcode Fuzzy Hash: e3499d07af07b3b1d19f954717213085031508bb009330ed3fd82e18d3cb0b96
Instruction Fuzzy Hash: A501D66264160FBA920866109F83FFA735CAF61BA4B000028FE049A241F620FD95B2A5

Function 00F92DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00F8F2DE,00F93863,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6), ref: 00F92DFD
_free.LIBCMT ref: 00F92E32
_free.LIBCMT ref: 00F92E59
SetLastError.KERNEL32(00000000,00F61129), ref: 00F92E66
SetLastError.KERNEL32(00000000,00F61129), ref: 00F92E6F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 29b9fee109f5190468905060efadca5f6f72ff77694d95df1c60be087cd1670a
Instruction ID: 3defa04777c486073523816f99465e8d7c1872a9ebdb0ee6f1a7e9f49fe16c2b
Opcode Fuzzy Hash: 29b9fee109f5190468905060efadca5f6f72ff77694d95df1c60be087cd1670a
Instruction Fuzzy Hash: 2101F93290560477FF6277356DC6D2F356DAFD13B57350028F415A2182EA688C0171A0

Function 00FC000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?,?,00FC035E), ref: 00FC002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?), ref: 00FC0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?), ref: 00FC0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?), ref: 00FC0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?), ref: 00FC0070

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 44adc316ba91c7e5122c2c20fa8438dfb3dab1497a2bc823330870d762eaec2d
Instruction ID: eb1977cf2864fe73408dbc4254441bfc7d3cef4dbe8f8721303a09d33464bc29
Opcode Fuzzy Hash: 44adc316ba91c7e5122c2c20fa8438dfb3dab1497a2bc823330870d762eaec2d
Instruction Fuzzy Hash: 38018F72640219FFDB104F68DE45FAA7AADEF447A1F154128F905D2210DB71DD41EBA0

Function 00FC10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FC1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FC114D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 092981185b6ca99870492f349868c2e38e5c7a9640e4087fa3c7dd6e9850e3cf
Instruction ID: 0b144a2c59a117bdb009de96ae433e31689ff51d61ca6390117e8c38011cc315
Opcode Fuzzy Hash: 092981185b6ca99870492f349868c2e38e5c7a9640e4087fa3c7dd6e9850e3cf
Instruction Fuzzy Hash: E5018C75A00219BFDB115FA5DD49E6A3F6EFF8A3A0B250418FA45D3361DB31DC10EAA0

Function 00FC0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FC0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FC0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FC0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FC0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FC1002

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 9f4a8710464d8a6a071810dffb8e4cf0eec8493d1e50b02c9f8acbab0beee245
Instruction ID: cf5cecfdcc06f0bb7047ee5174264f548b30b1d6106b250050c19ae03b12b086
Opcode Fuzzy Hash: 9f4a8710464d8a6a071810dffb8e4cf0eec8493d1e50b02c9f8acbab0beee245
Instruction Fuzzy Hash: F7F0C235140319EBD7210FA5DE4EF663B6DFF8A761F100415F945C7252CA30DC50EAA0

Function 00FC1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FC102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1062

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3261e2d4cb6adbc266bc320e4dae6001fe936342578523c9b0eecb7937912ba8
Instruction ID: 717c5909eaf45df7aeea03cfe0579fe75af1b67fb34c17f6aef4ab72a70ee084
Opcode Fuzzy Hash: 3261e2d4cb6adbc266bc320e4dae6001fe936342578523c9b0eecb7937912ba8
Instruction Fuzzy Hash: 43F0C235140319EBD7211FA5EE4AF663B6DFF8A761F100414FD45C7251CA31D850EAA0

Function 00FD030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD0324
CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD0331
CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD033E
CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD034B
CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD0358
CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD0365

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 10202790443f842a9d3b5ac4502b4915a28d185cf3bd5b4e014b528a1d77736d
Instruction ID: 95beeed2fd2da6d3ba437a7184c0cc9310b25f9b35d135623af197818bf82e66
Opcode Fuzzy Hash: 10202790443f842a9d3b5ac4502b4915a28d185cf3bd5b4e014b528a1d77736d
Instruction Fuzzy Hash: 4D01A272800B559FC731AF66D880916F7FABF503253198A3FD19652A31C7B1A954EF80

Function 00F9D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F9D752

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F9D764
_free.LIBCMT ref: 00F9D776
_free.LIBCMT ref: 00F9D788
_free.LIBCMT ref: 00F9D79A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1ca62c3d4b1457286836a955021bdb1c7ea265627a786578fdc8953feacd3841
Instruction ID: 2e15d2b8a0b94559bf370a220b48dadb1e64d34e31beaccb81bc99b5f63fa464
Opcode Fuzzy Hash: 1ca62c3d4b1457286836a955021bdb1c7ea265627a786578fdc8953feacd3841
Instruction Fuzzy Hash: 7AF0F4329442047BAE75EA98FAC5C1A77EDBB447207B40809F44CD7505C729FC4067A5

Function 00FC5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00FC5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00FC5C6F
MessageBeep.USER32(00000000), ref: 00FC5C87
KillTimer.USER32(?,0000040A), ref: 00FC5CA3
EndDialog.USER32(?,00000001), ref: 00FC5CBD

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 166230b031d4a347328cd0d9a12f9ec1b43c4baea66d6369742786561db0a487
Instruction ID: 752e91d92286dec2aa71f10f5fbd22f6565572ad849d6004acbf840ecca9be96
Opcode Fuzzy Hash: 166230b031d4a347328cd0d9a12f9ec1b43c4baea66d6369742786561db0a487
Instruction Fuzzy Hash: 69016271500B19ABEB209B20DF4FFA677BCBF00F05F00055DA596A10E1DBF4B988EA90

Function 00F922A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F922BE

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F922D0
_free.LIBCMT ref: 00F922E3
_free.LIBCMT ref: 00F922F4
_free.LIBCMT ref: 00F92305

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dc535012212fcc7c87d7e19e992f5ca15a56143f70de0631c9acfeb150719e15
Instruction ID: c774c4329a9015909279020a0ecbc68c8de4b4175e8797c3fee5e3a967e351d5
Opcode Fuzzy Hash: dc535012212fcc7c87d7e19e992f5ca15a56143f70de0631c9acfeb150719e15
Instruction Fuzzy Hash: 4FF03AB0801520ABAB72EF58F80180C3B78B718760700050AF494D22ADC73E0921FBE4

Function 00F795C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00F795D4
StrokeAndFillPath.GDI32(?,?,00FB71F7,00000000,?,?,?), ref: 00F795F0
SelectObject.GDI32(?,00000000), ref: 00F79603
DeleteObject.GDI32 ref: 00F79616
StrokePath.GDI32(?), ref: 00F79631

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: f1adfe572a8fb09ba1de49c2461b98bdd449daac36d394f6ad19dae7ec4c4ff1
Instruction ID: 9373e2edebdc666c961a7022bb7d4a94f3d49aabc2ddee7ed1a22cc6f9b7928b
Opcode Fuzzy Hash: f1adfe572a8fb09ba1de49c2461b98bdd449daac36d394f6ad19dae7ec4c4ff1
Instruction Fuzzy Hash: 80F0813000920CDBC7224F14ED0C7743B69AB04332F048316F499550F4CB758551EF61

Function 00F90F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00F910F9
__freea.LIBCMT ref: 00F91117

Part of subcall function 00F91537: _free.LIBCMT ref: 00F9154F

Strings

am/pm, xrefs: 00F9117A
a/p, xrefs: 00F911DE

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 6f62f8d20b4f00ba7268cf8ddce6e8f485d0ec323229a6debca326cde45d897d
Instruction ID: 2af8196daa022303fabbc40c185640f7dfc1dcde703ac602849d269caf1bf189
Opcode Fuzzy Hash: 6f62f8d20b4f00ba7268cf8ddce6e8f485d0ec323229a6debca326cde45d897d
Instruction Fuzzy Hash: A1D1CF32E00207DAFF299F68C845BBAB7B4FF05320F284179EA059B650D7759D80EB91

Function 00FE7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00F80242: EnterCriticalSection.KERNEL32(0103070C,01031884,?,?,00F7198B,01032518,?,?,?,00F612F9,00000000), ref: 00F8024D
Part of subcall function 00F80242: LeaveCriticalSection.KERNEL32(0103070C,?,00F7198B,01032518,?,?,?,00F612F9,00000000), ref: 00F8028A

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00F800A3: __onexit.LIBCMT ref: 00F800A9

__Init_thread_footer.LIBCMT ref: 00FE7BFB

Part of subcall function 00F801F8: EnterCriticalSection.KERNEL32(0103070C,?,?,00F78747,01032514), ref: 00F80202
Part of subcall function 00F801F8: LeaveCriticalSection.KERNEL32(0103070C,?,00F78747,01032514), ref: 00F80235

Strings

Variable must be of type 'Object'., xrefs: 00FE7C3A
5, xrefs: 00FE7C78
G, xrefs: 00FE7C7F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 553d02589444260de06075160b651a43111a3e9d6197b446ae1fb9b095a394ba
Instruction ID: 64706b74b177f4eb8001ba2356f372e147ff1c38dce7edc4a6a8404839ee22b0
Opcode Fuzzy Hash: 553d02589444260de06075160b651a43111a3e9d6197b446ae1fb9b095a394ba
Instruction Fuzzy Hash: 1C91BD70A04389EFCB14EF56D8909BDB7B6FF48300F148059F806AB292DB75AE41EB51

Function 00FC2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00FC21D0,?,?,00000034,00000800,?,00000034), ref: 00FCB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00FC2760

Part of subcall function 00FCB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00FC21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00FCB3F8

Part of subcall function 00FCB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00FCB355
Part of subcall function 00FCB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00FC2194,00000034,?,?,00001004,00000000,00000000), ref: 00FCB365
Part of subcall function 00FCB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00FC2194,00000034,?,?,00001004,00000000,00000000), ref: 00FCB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00FC27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00FC281A

Strings

@, xrefs: 00FC2832

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 791575b64fb00375485618e46674a4176185926d074338b92853deb24fa0f4f0
Instruction ID: 9964e191f3ec02ef1f265791bae6ddc8ecbd93030c3bc329c9b0aa85c8da5814
Opcode Fuzzy Hash: 791575b64fb00375485618e46674a4176185926d074338b92853deb24fa0f4f0
Instruction Fuzzy Hash: 2C413A76D00219AEDB10DFA4CE86FEEBBB8EF09300F104059EA45B7181DA706E45DBA1

Function 00F9172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00F91769
_free.LIBCMT ref: 00F91834
_free.LIBCMT ref: 00F9183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00F91760, 00F91767, 00F91796, 00F917CE

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 43ba05cb90312381a543df3528a911289d473107edd889cc4f2d9ee818b38777
Instruction ID: 41aa743a1be3be48271ca4172ff9990c525693722852b73b91de391a84832a9a
Opcode Fuzzy Hash: 43ba05cb90312381a543df3528a911289d473107edd889cc4f2d9ee818b38777
Instruction Fuzzy Hash: E0318F71E0021AAFEF21DB999C81D9EBBBCFB85320B1441B6F80497211D6748A41EBA1

Function 00FCC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00FCC306
DeleteMenu.USER32(?,00000007,00000000), ref: 00FCC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,01031990,010E5B58), ref: 00FCC395

Strings

0, xrefs: 00FCC2DF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: ffe87655647f6dce6eaadd7434afaa88ca0bbe0f88bef815488c21fb3f687075
Instruction ID: 995c86fdf4858bc1e1208157be1f5b54bb22edf6e54622275f061ce4492e5d02
Opcode Fuzzy Hash: ffe87655647f6dce6eaadd7434afaa88ca0bbe0f88bef815488c21fb3f687075
Instruction Fuzzy Hash: 1541C2316043429FD720DF25ED46F5ABBE8AF85320F04861DF9A9D72D1C734A804EB92

Function 00FF4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00FFCC08,00000000,?,?,?,?), ref: 00FF44AA
GetWindowLongW.USER32 ref: 00FF44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FF44D7

Strings

SysTreeView32, xrefs: 00FF447C

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 4ec42014ae3cbb318ae19e6a448f0cdb6a23e74086e925c889cc66fd60db19cc
Instruction ID: 34e9c5bd266a761bbf9fa5bef433fbd30b11667556cd8ce4dd5d662f19c38074
Opcode Fuzzy Hash: 4ec42014ae3cbb318ae19e6a448f0cdb6a23e74086e925c889cc66fd60db19cc
Instruction Fuzzy Hash: F2316B31614209AFDB209E38DC45BEB77A9EF08334F244725FA79A22E0D774EC50AB50

Function 00FE304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00FE3077,?,?), ref: 00FE3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FE307A
_wcslen.LIBCMT ref: 00FE309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00FE3106

Strings

255.255.255.255, xrefs: 00FE3095, 00FE309A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: f7a443cdabab5422e12b708b4f49863ee52a7b911e8233b5670923f8e58995b8
Instruction ID: 28a59a4ba9130992e6956b102f7a198f048917f2e3bd858765a92ca9063fd552
Opcode Fuzzy Hash: f7a443cdabab5422e12b708b4f49863ee52a7b911e8233b5670923f8e58995b8
Instruction Fuzzy Hash: F6310735A042859FCB20CF2AC98DEA977E0EF54328F258059E9158B392C776EF41E761

Function 00FF3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00FF3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00FF3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00FF3F78

Strings

SysMonthCal32, xrefs: 00FF3F0B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: b3a7462e561501787db5ef26ddf7e0fe5cad57c2a3876f5918cc2b4277a5c64a
Instruction ID: 163af088c42fdd3873e8f11ce4cea634ebdcddce3891bd19cffb07d750a96a41
Opcode Fuzzy Hash: b3a7462e561501787db5ef26ddf7e0fe5cad57c2a3876f5918cc2b4277a5c64a
Instruction Fuzzy Hash: 33219F32A0021DBBDF258F50CC46FEA3B79EF48724F110214FA55AB1D0D6B5A954EB90

Function 00FF4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00FF4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00FF4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00FF471A

Strings

msctls_updown32, xrefs: 00FF4684

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: a16b2ab4d33cef2ae5ac69829a7194d6858a0e017e1e3bed3a66f3841a397912
Instruction ID: f3ee4e8d4e173306015e57a0cbf739ef835fe0e179ea53d765b8708235032428
Opcode Fuzzy Hash: a16b2ab4d33cef2ae5ac69829a7194d6858a0e017e1e3bed3a66f3841a397912
Instruction Fuzzy Hash: 98212CB5600209AFDB10DF64DC81DB737ADEF9A3A8B040559FA049B261CB75FC11EB60

Function 00FC95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FC961D

Strings

#OnAutoItStartRegister, xrefs: 00FC95F3
#requireadmin, xrefs: 00FC95D9
#notrayicon, xrefs: 00FC95B7

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: fc74989de326e79cfa4d1099cc715df481038ae70b976b8ce1126a8f20a24abd
Instruction ID: f6365361145ad7f57a1f84025982ded87e38fdc9723cfb98abef49e2c20ad821
Opcode Fuzzy Hash: fc74989de326e79cfa4d1099cc715df481038ae70b976b8ce1126a8f20a24abd
Instruction Fuzzy Hash: 3B213432A0821266C331BA24DE0BFB773D8AF90320F54442AFA4996081EBA5AD45F395

Function 00FF37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00FF3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00FF3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00FF3876

Strings

Listbox, xrefs: 00FF380F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 85fb8137a7e89dbe802a483af7f4a5a28f457388b2f1f98206187d58eabc851f
Instruction ID: b23066bf39726cb90bac36c1383f906b396e490297e067bca1323e4430c4a24d
Opcode Fuzzy Hash: 85fb8137a7e89dbe802a483af7f4a5a28f457388b2f1f98206187d58eabc851f
Instruction Fuzzy Hash: 28217F72A1411CBBEB219F54CC45EBB376EEF897A0F118124FA449B1A0C675DC52D7A0

Function 00FD49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FD4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00FD4A5C
SetErrorMode.KERNEL32(00000000,?,?,00FFCC08), ref: 00FD4AD0

Strings

%lu, xrefs: 00FD4A6F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: a9fa6e9dafaeca160047d6f2a020fcd5a2ca34dbbeaef90986d6f4a324e804bc
Instruction ID: 9ba49bcc2f9b5d312da7579ae367831663292835f4edd36326d0b5bcea611349
Opcode Fuzzy Hash: a9fa6e9dafaeca160047d6f2a020fcd5a2ca34dbbeaef90986d6f4a324e804bc
Instruction Fuzzy Hash: 60318E75A00109AFDB10DF64C981EAA7BF8EF08318F1480A9E909DB352D775ED45EBA1

Function 00FF41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00FF424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00FF4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00FF4271

Strings

msctls_trackbar32, xrefs: 00FF4226

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 3aad9f995dae9214e3becdc1c71a73ca2bae0fa1cb68d9a0385a05c2eca95d3e
Instruction ID: 5edc46e6ed93dbbefc29ea822c9e5542825c89f6b645dd06413bb5f05d8ea0df
Opcode Fuzzy Hash: 3aad9f995dae9214e3becdc1c71a73ca2bae0fa1cb68d9a0385a05c2eca95d3e
Instruction Fuzzy Hash: 8711E33164024CBEEF215F29CC46FBB3BACEF95B64F010525FA55E60A0D271E811EB24

Function 00FC2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

Part of subcall function 00FC2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00FC2DC5
Part of subcall function 00FC2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC2DD6
Part of subcall function 00FC2DA7: GetCurrentThreadId.KERNEL32 ref: 00FC2DDD
Part of subcall function 00FC2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00FC2DE4

GetFocus.USER32 ref: 00FC2F78

Part of subcall function 00FC2DEE: GetParent.USER32(00000000), ref: 00FC2DF9

GetClassNameW.USER32(?,?,00000100), ref: 00FC2FC3
EnumChildWindows.USER32(?,00FC303B), ref: 00FC2FEB

Strings

%s%d, xrefs: 00FC2FFF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: e613bcb53241d3fba7d2bf3b4535ad4ca7c4b7c69a6b6244671e63407e5587ca
Instruction ID: 430d2c2e638a90af704763f68eab3b17369a0fcaad8f84b01bc7edd7a9205178
Opcode Fuzzy Hash: e613bcb53241d3fba7d2bf3b4535ad4ca7c4b7c69a6b6244671e63407e5587ca
Instruction Fuzzy Hash: CA11D27160020AABCF407F608D86FFD376AAF94304F048079F909DB292DE749909EB60

Function 00FF5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00FF58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00FF58EE
DrawMenuBar.USER32(?), ref: 00FF58FD

Strings

0, xrefs: 00FF588F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: fc340b3c895d6b18807d6bc9d1829292b5937d5896adb03e3d90a2304acdbc74
Instruction ID: 6d40f46d71961d0e95a01305078579dce0a9ac2a3f268821e3aa7715b1b3a2e6
Opcode Fuzzy Hash: fc340b3c895d6b18807d6bc9d1829292b5937d5896adb03e3d90a2304acdbc74
Instruction Fuzzy Hash: 00015E3190021CEEDB219F11DC44BBEBBB8FF45760F148099EA49D6261DB708A88FF61

Function 00FC007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86309ed4f0641739387c353859ade62f8061566d8c5deae2fed7f51770820e97
Instruction ID: 5ec05fd4c8deaf832e18f17e401e5d3274172eecd82283d7009c75a927904024
Opcode Fuzzy Hash: 86309ed4f0641739387c353859ade62f8061566d8c5deae2fed7f51770820e97
Instruction Fuzzy Hash: DDC14875A0021AEFDB04CFA4C995FAAB7B5FF48314F148598E505EB251CB31ED42EB90

Function 00F93E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F93F0B
__alldvrm.LIBCMT ref: 00F9410C
__alldvrm.LIBCMT ref: 00F9412E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: a287e556a7e85df2575db191f22ca9d9a44811e44edb559230fa511291582ae1
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 39A15976D003869FFF26CF18C891BAEBBE4EF71364F14416DE5559B281C238A982E750

Function 00FE342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FE3459
CoUninitialize.OLE32 ref: 00FE3463
VariantInit.OLEAUT32(?), ref: 00FE346E
VariantClear.OLEAUT32(?), ref: 00FE371B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 6c65a9178b5f83d2286b35ec3a20e77e9f0a65f67223648d0b87867d6efd7ded
Instruction ID: 0230b59df41a3006bac9168d96d27a7c187371f57640d26ddbb2cafb5fcfabe9
Opcode Fuzzy Hash: 6c65a9178b5f83d2286b35ec3a20e77e9f0a65f67223648d0b87867d6efd7ded
Instruction Fuzzy Hash: ECA13E756043119FC710EF25C989A2AB7E5FF88714F08885DF98A9B362DB34ED01EB91

Function 00FC0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00FFFC08,?), ref: 00FC05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00FFFC08,?), ref: 00FC0608
CLSIDFromProgID.OLE32(?,?,00000000,00FFCC40,000000FF,?,00000000,00000800,00000000,?,00FFFC08,?), ref: 00FC062D
_memcmp.LIBVCRUNTIME ref: 00FC064E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: ce8e0028437dd49c7a671b891d2a7277d293e5c9ef59849189aa94970e413888
Instruction ID: 798a7cf4db9263f8db99647e41b76c6a064ffc0fa94b5355e9233494411685d7
Opcode Fuzzy Hash: ce8e0028437dd49c7a671b891d2a7277d293e5c9ef59849189aa94970e413888
Instruction Fuzzy Hash: 3B811A71A0010AEFCB04DF94CA85EEEB7B9FF89315F244558E506AB250DB71AE06DF60

Function 00FA1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FA14C0

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3e403f880e7b49bf90a5ae862719ee8357261d5f8167ff646ce9625284b1f55e
Instruction ID: ddb4f9c8e53be677e6aff2e99b7d12206ea17112ca601deca7683753adcaa357
Opcode Fuzzy Hash: 3e403f880e7b49bf90a5ae862719ee8357261d5f8167ff646ce9625284b1f55e
Instruction Fuzzy Hash: D9410AB1E002146FEF21FBBD8C45AAE3AA5FF4B370F164225F819D6191E778484173A1

Function 00FF6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FF62E2
ScreenToClient.USER32(?,?), ref: 00FF6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00FF6382

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 39b5fca68ac999a8ab40250f7c1909737d901578f85b4731ab26a86a100538ab
Instruction ID: 1898507ebb6df250639ea3e6de0276cc9746c656ec7410402804c2ec150f7989
Opcode Fuzzy Hash: 39b5fca68ac999a8ab40250f7c1909737d901578f85b4731ab26a86a100538ab
Instruction Fuzzy Hash: 2F511874A00209AFCF24DF68D9809BE7BB5EF55360F108169F955DB2A0DB30AD41EB90

Function 00FE1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00FE1AFD
WSAGetLastError.WSOCK32 ref: 00FE1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00FE1B8A
WSAGetLastError.WSOCK32 ref: 00FE1B94

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 4a4369be2f672b5ec6abe4fd27f90c6561d7d47a1330fc2332760e964d207c3e
Instruction ID: 89fb3bece4c9dc989e74dad124db51b10816b748257254c77b6b6a6b248c91ae
Opcode Fuzzy Hash: 4a4369be2f672b5ec6abe4fd27f90c6561d7d47a1330fc2332760e964d207c3e
Instruction Fuzzy Hash: 3B41A035600200AFE720AF25C886F2A77E5AF84718F54C488F95A9F3D2D776ED41DB91

Function 00F9B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b86673d3ceaa91cb4e38e75e2edbb3184c5347880323414764a261b6550c7a
Instruction ID: 14162f42431190d4dc7df41b810df1b98193b77fa8164ae9f44c372f53a97723
Opcode Fuzzy Hash: 90b86673d3ceaa91cb4e38e75e2edbb3184c5347880323414764a261b6550c7a
Instruction Fuzzy Hash: C0411B75E00304BFEB24EF7CDD41BAA7BE9EB84720F10452AF151DB291D775A901A790

Function 00FD56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00FD5783
GetLastError.KERNEL32(?,00000000), ref: 00FD57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00FD57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00FD57FA

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: d5646b67b505eb458f59ea667e926a34c610998bad806c55ee90848990c7ae85
Instruction ID: d76bd9afa8144c05a7036352852e50328d3f2f8bcd119bb6621d5f979159f5d4
Opcode Fuzzy Hash: d5646b67b505eb458f59ea667e926a34c610998bad806c55ee90848990c7ae85
Instruction Fuzzy Hash: 31414E35600614DFCB11EF15C944A5EBBF2EF89724B198489E84AAB366CB34FD40EB91

Function 00F9D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00F86D71,00000000,00000000,00F882D9,?,00F882D9,?,00000001,00F86D71,8BE85006,00000001,00F882D9,00F882D9), ref: 00F9D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F9D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00F9D9AB
__freea.LIBCMT ref: 00F9D9B4

Part of subcall function 00F93820: RtlAllocateHeap.NTDLL(00000000,?,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6,?,00F61129), ref: 00F93852

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 0fef76672ea67045f9dad27334e4e7dc4a5b37e874814d4a7aa08732bad07e16
Instruction ID: f92ccebdac5bf1eaabca3a289505972a541b7317fe977603db0b8c996f943b2d
Opcode Fuzzy Hash: 0fef76672ea67045f9dad27334e4e7dc4a5b37e874814d4a7aa08732bad07e16
Instruction Fuzzy Hash: 7E31E172A0021AABEF24EF64DC41EAE7BA5EF40360F254169FC04D7150EB39DD50EB90

Function 00FF52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00FF5352
GetWindowLongW.USER32(?,000000F0), ref: 00FF5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FF5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FF53A8

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: f37a568165cd7b4c5842ffee246066b99af42600002fae6512727430a53640e0
Instruction ID: 550e9c1bb7135f94a09dde6e1dad2d937c1deece4ef7b0110b2178c983f02792
Opcode Fuzzy Hash: f37a568165cd7b4c5842ffee246066b99af42600002fae6512727430a53640e0
Instruction Fuzzy Hash: 1031AD35E55A0CAEEB309A58CC05BF877A7AF04BA0F584102BB50962F1C7B59940BB82

Function 00FCAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00FCABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00FCAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00FCAC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00FCACC6

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c06d3f1d406ae1cf6eb2095026d1068cb4ab19eaff9578f3869481dc6abd1a57
Instruction ID: 32cb83e624143608bfbd9d340bddc99ea77d9f4b01fda15d3964aebebe14246a
Opcode Fuzzy Hash: c06d3f1d406ae1cf6eb2095026d1068cb4ab19eaff9578f3869481dc6abd1a57
Instruction Fuzzy Hash: EB314A30E0421E6FEF35CB648E0AFFA7BA5AB44328F04421EE484921D0C375E985A792

Function 00FF7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00FF769A
GetWindowRect.USER32(?,?), ref: 00FF7710
PtInRect.USER32(?,?,00FF8B89), ref: 00FF7720
MessageBeep.USER32(00000000), ref: 00FF778C

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 429070a6fed49d6aeb34b88a21543cead656816424e6c08a8a2ea828c0ca49a3
Instruction ID: fd6ea4ccdd7c8ded68ad5908cc904e3062c7e6d22052742103008e279cf52d88
Opcode Fuzzy Hash: 429070a6fed49d6aeb34b88a21543cead656816424e6c08a8a2ea828c0ca49a3
Instruction Fuzzy Hash: 7841AD36A0931DEFCB11EF58C884EB9FBF5BF48714F1940A9E6549B260C331A941EB90

Function 00FF16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00FF16EB

Part of subcall function 00FC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC3A57
Part of subcall function 00FC3A3D: GetCurrentThreadId.KERNEL32 ref: 00FC3A5E
Part of subcall function 00FC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00FC25B3), ref: 00FC3A65

GetCaretPos.USER32(?), ref: 00FF16FF
ClientToScreen.USER32(00000000,?), ref: 00FF174C
GetForegroundWindow.USER32 ref: 00FF1752

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 5a6048712b3f1299c783350015dda4cbc1bec9a3c576f68e29ecda123a17c10e
Instruction ID: c9388b34e1eeca55e64db78e6151e8c429729652a1290a9a826b467e6e80a7cb
Opcode Fuzzy Hash: 5a6048712b3f1299c783350015dda4cbc1bec9a3c576f68e29ecda123a17c10e
Instruction Fuzzy Hash: AB315E76D00249AFC700EFA9C981DBEBBFDEF48304B5480AAE455E7211E7359E45DBA0

Function 00FCDF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00F67620: _wcslen.LIBCMT ref: 00F67625

_wcslen.LIBCMT ref: 00FCDFCB
_wcslen.LIBCMT ref: 00FCDFE2
_wcslen.LIBCMT ref: 00FCE00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00FCE018

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: c78e5b52f129ffd6fe49d027b0564a51028ca235d009a559fa1cbb5002647398
Instruction ID: dc0e8fce48da769c89ca5dcda411ed3e9591b394e180b3aaf489b1f14d4b7e46
Opcode Fuzzy Hash: c78e5b52f129ffd6fe49d027b0564a51028ca235d009a559fa1cbb5002647398
Instruction Fuzzy Hash: 7A21D671D00215AFCB20EF64DD82BAEB7F8EF45720F104069E804BB241D6749D41DBE1

Function 00FCD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00FCD501
Process32FirstW.KERNEL32(00000000,?), ref: 00FCD50F
Process32NextW.KERNEL32(00000000,?), ref: 00FCD52F
CloseHandle.KERNEL32(00000000), ref: 00FCD5DC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: da3f6fcd9b2a67bcf703ca6ba9b68a32d90d66a04b9b10b4ff85ea96f4cd8a53
Instruction ID: d72097c11eaa3652dbbf8bca0686501072d062348d3d6ee222da0aaaadd4bb8b
Opcode Fuzzy Hash: da3f6fcd9b2a67bcf703ca6ba9b68a32d90d66a04b9b10b4ff85ea96f4cd8a53
Instruction Fuzzy Hash: AA3190710082059FD300EF64CD82EAFBBE8EF99354F14092DF581921A1EB719944EB92

Function 00FF8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

GetCursorPos.USER32(?), ref: 00FF9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00FB7711,?,?,?,?,?), ref: 00FF9016
GetCursorPos.USER32(?), ref: 00FF905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00FB7711,?,?,?), ref: 00FF9094

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 8b8b661a64a2ae041ffbe9a19ce3fe4bac4d379c851517e5cd553d94dac9e415
Instruction ID: ef7f676b816d261f1cfa5c41c9adc9bf61e3a2864dc4c929d858247bdf6bde18
Opcode Fuzzy Hash: 8b8b661a64a2ae041ffbe9a19ce3fe4bac4d379c851517e5cd553d94dac9e415
Instruction Fuzzy Hash: 25216035A0401CEFDB258FA4C858FFA7BB9EF89360F144055F6054B2A1C7759990EF64

Function 00FCD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00FFCB68), ref: 00FCD2FB
GetLastError.KERNEL32 ref: 00FCD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FCD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00FFCB68), ref: 00FCD376

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 2a009a0817cf6fb9584217c3c421d7f1707975da2aba37117bffff6d5e0c82b5
Instruction ID: dde1764a91e15e29860b5eb4644ebfcd350ea978ab8ab43b39809c7773232632
Opcode Fuzzy Hash: 2a009a0817cf6fb9584217c3c421d7f1707975da2aba37117bffff6d5e0c82b5
Instruction Fuzzy Hash: 6421B7705083069F8300DF24CA8296E77E8EE55364F504A2DF499C72A1D731D949EB93

Function 00FC1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FC102A
Part of subcall function 00FC1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1036
Part of subcall function 00FC1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1045
Part of subcall function 00FC1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC104C
Part of subcall function 00FC1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00FC15BE
_memcmp.LIBVCRUNTIME ref: 00FC15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC1617
HeapFree.KERNEL32(00000000), ref: 00FC161E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 9fae5c7479e91cb0cadba35bc937479ed0821f28fa898f681386854e86ee1357
Instruction ID: 21aadc39aedf3ad9ffe39c4c8388fecfcb8f54451cbfb229842ab364d7d03e6b
Opcode Fuzzy Hash: 9fae5c7479e91cb0cadba35bc937479ed0821f28fa898f681386854e86ee1357
Instruction Fuzzy Hash: 57217C71E0010AAFDB10DFA4CA46FEEB7B8FF45354F184459E441A7242D734AA15EB90

Function 00FF2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00FF280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00FF2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00FF2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00FF2840

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 62f9f093a469796245905c79d0acd1ad727a5e36b1070e583cfb0753a1b0d8de
Instruction ID: 46c7c6618156a19f05ee834c5c1d6603110a396a6e734fbc26263d6d39f2adcf
Opcode Fuzzy Hash: 62f9f093a469796245905c79d0acd1ad727a5e36b1070e583cfb0753a1b0d8de
Instruction Fuzzy Hash: 1C21E032604519AFD7149B24CC44FBA7B99AF45324F188158F5268B2E2CB75EC82EBD0

Function 00FC78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00FC790A,?,000000FF,?,00FC8754,00000000,?,0000001C,?,?), ref: 00FC8D8C
Part of subcall function 00FC8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00FC8DB2
Part of subcall function 00FC8D7D: lstrcmpiW.KERNEL32(00000000,?,00FC790A,?,000000FF,?,00FC8754,00000000,?,0000001C,?,?), ref: 00FC8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00FC8754,00000000,?,0000001C,?,?,00000000), ref: 00FC7923
lstrcpyW.KERNEL32(00000000,?), ref: 00FC7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00FC8754,00000000,?,0000001C,?,?,00000000), ref: 00FC7984

Strings

cdecl, xrefs: 00FC797B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 9bcb9535fd0b3846ab771dd592f80c171df06096bb0816c33ef1b86fe9c88521
Instruction ID: 2ca26dadb256592be50fa9bb6d9d24daa8b191291734c64fc78006719ef3ae09
Opcode Fuzzy Hash: 9bcb9535fd0b3846ab771dd592f80c171df06096bb0816c33ef1b86fe9c88521
Instruction Fuzzy Hash: 7811063A200306ABCB156F34DC46E7B77A9FF453A0B10402EF946C7264EB319811EBA1

Function 00FF7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00FF7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00FF7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00FF7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00FDB7AD,00000000), ref: 00FF7D6B

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 3a1e427b203480dd1de48b20facfd8d58dedffe96fb9bf7f008df0e4a56b93ba
Instruction ID: c5b54ed063b4255d6b203a2326ce085c16b99fe9dfd2264aff5d3d5b9059a579
Opcode Fuzzy Hash: 3a1e427b203480dd1de48b20facfd8d58dedffe96fb9bf7f008df0e4a56b93ba
Instruction Fuzzy Hash: 3411A23250872DAFCB10AF28CC04A7A7BA9AF49370B558725F939D72F0D7319951EB90

Function 00FF5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00FF56BB
_wcslen.LIBCMT ref: 00FF56CD
_wcslen.LIBCMT ref: 00FF56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00FF5816

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: bafafc70ac1de7542857046f63ab74c098468987cc1762ebcf71d91861539ce3
Instruction ID: 7c3982f0a903ae5428433c8cb4cf053c37c8d2f4334b1136c1ff0c072a5faef6
Opcode Fuzzy Hash: bafafc70ac1de7542857046f63ab74c098468987cc1762ebcf71d91861539ce3
Instruction Fuzzy Hash: 7211B472A0061D96DF20DF618C85AFE77ACAF11B70B10402AFB15D6091E774D980EB60

Function 00F91D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ad7d8d6efbbdcdae33af33a100e69e0e8b003378000753641c819ddfdc9da
Instruction ID: 9af107f1204605c9aad03859aea3e790f63dd5dcb6510866376bbbcd61e7458c
Opcode Fuzzy Hash: a72ad7d8d6efbbdcdae33af33a100e69e0e8b003378000753641c819ddfdc9da
Instruction Fuzzy Hash: B1018BB260A61B3EFE2126786CC0F27762CEF413B8B300336F521A11D2DB648C04B1A0

Function 00FC1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00FC1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FC1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FC1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FC1A8A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d21014524a3f3d649466f0dc451c283810daf6f83f566905d2c4860468f13def
Instruction ID: a206a82602e57eb54dd2dd1c27257c497568aac65a5449d54c15b2eb9786aed2
Opcode Fuzzy Hash: d21014524a3f3d649466f0dc451c283810daf6f83f566905d2c4860468f13def
Instruction Fuzzy Hash: D7113C3AD01219FFEB10DBA4CD85FADBB78FB04750F200095E604B7290D6716E50EB94

Function 00FCE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FCE1FD
MessageBoxW.USER32(?,?,?,?), ref: 00FCE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00FCE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00FCE24D

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 0ca4f4ed1ea37716ecffd512474f5734d4827d191d7ce24b77046a5c32705774
Instruction ID: 937a2182bccc53aaadbafc7ee70dcef7936fcccf0e6017bc425a00adaa20e561
Opcode Fuzzy Hash: 0ca4f4ed1ea37716ecffd512474f5734d4827d191d7ce24b77046a5c32705774
Instruction Fuzzy Hash: 4A110472D0421DBBC7119FA89D0AFEE7FACAF45320F008219F824E3280D3B5C900A7A0

Function 00F8D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00F8CFF9,00000000,00000004,00000000), ref: 00F8D218
GetLastError.KERNEL32 ref: 00F8D224
__dosmaperr.LIBCMT ref: 00F8D22B
ResumeThread.KERNEL32(00000000), ref: 00F8D249

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 9521e0ff2621a6e4ffe9093cc96d46c626abbdbf3036f5739b4d48a361e33996
Instruction ID: 921a59f43b80200277cadb11833c04d8f3656e0f0db01296b9177f7d017c0977
Opcode Fuzzy Hash: 9521e0ff2621a6e4ffe9093cc96d46c626abbdbf3036f5739b4d48a361e33996
Instruction Fuzzy Hash: BC01DE36805218BBDB217BA5DC09BEE7B6DEF81330F200259F925921E0CB70C905F7A1

Function 00FF9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

GetClientRect.USER32(?,?), ref: 00FF9F31
GetCursorPos.USER32(?), ref: 00FF9F3B
ScreenToClient.USER32(?,?), ref: 00FF9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00FF9F7A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: ba102447cb133f9457cb9a8c2137b312819d89a5003c47fb9f412c1c6fdc1d4f
Instruction ID: adae51e239edf77ac06c296768ae6d8ae2d942ade69d0444f25032f7bd8e4d12
Opcode Fuzzy Hash: ba102447cb133f9457cb9a8c2137b312819d89a5003c47fb9f412c1c6fdc1d4f
Instruction Fuzzy Hash: B311253290412EABDB10EF68C885AFE77BCEF45311F000451FA11E71A0D7B4BA85EBA1

Function 00F6600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F6604C
GetStockObject.GDI32(00000011), ref: 00F66060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F6606A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 9b20f890b694220bed67d7ea13471fd8c8d81c4842714ada5fe63bd8b9aad862
Instruction ID: 96e22690b604beee42ea91486547eb951bddb6e8fd1d49d4adf15281f9c106b0
Opcode Fuzzy Hash: 9b20f890b694220bed67d7ea13471fd8c8d81c4842714ada5fe63bd8b9aad862
Instruction Fuzzy Hash: 5C11577350151CBFEF229FA49D44AEABF6DEF093A4F040226FA1592110D7769C60EBA0

Function 00F83B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00F83B56

Part of subcall function 00F83AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00F83AD2
Part of subcall function 00F83AA3: ___AdjustPointer.LIBCMT ref: 00F83AED

_UnwindNestedFrames.LIBCMT ref: 00F83B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00F83B7C
CallCatchBlock.LIBVCRUNTIME ref: 00F83BA4

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 2a2bea528cb991bd0838d3d200b045597b896fe87ec710f9bdd001e55361065f
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 12012972500149BBDF126E95CC46EEB3F69EF88B64F044014FE4896121D736E961EBA0

Function 00F93073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00F613C6,00000000,00000000,?,00F9301A,00F613C6,00000000,00000000,00000000,?,00F9328B,00000006,FlsSetValue), ref: 00F930A5
GetLastError.KERNEL32(?,00F9301A,00F613C6,00000000,00000000,00000000,?,00F9328B,00000006,FlsSetValue,01002290,FlsSetValue,00000000,00000364,?,00F92E46), ref: 00F930B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F9301A,00F613C6,00000000,00000000,00000000,?,00F9328B,00000006,FlsSetValue,01002290,FlsSetValue,00000000), ref: 00F930BF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: d7612df3d1b873bc75223621d278473cb04fe82f9ef571c492297a196c1571ff
Instruction ID: 217b56f94b637e1e536ff9913073660490265ea726c71e3ad010510d13cd069a
Opcode Fuzzy Hash: d7612df3d1b873bc75223621d278473cb04fe82f9ef571c492297a196c1571ff
Instruction Fuzzy Hash: 7E012B3270133AABEF314B799C44A677B9CEF05BB5B110620F915E3150C721DD05D6E0

Function 00FC7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00FC747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00FC7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00FC74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00FC74CA

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: ff4850a6622a94433d766a579dedd601b52832f39cc960555c7ad65b51abeda0
Instruction ID: 03e0104bac1996c365c93201db132eba25749a554a25e4bd28cd5ae51f1bc86a
Opcode Fuzzy Hash: ff4850a6622a94433d766a579dedd601b52832f39cc960555c7ad65b51abeda0
Instruction Fuzzy Hash: EA113CB520571ADBE724DF14DE0AFA2BBBCEB00B04F10856DA666D6191D7B0E904EF90

Function 00FCB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00FCACD3,?,00008000), ref: 00FCB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00FCACD3,?,00008000), ref: 00FCB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00FCACD3,?,00008000), ref: 00FCB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00FCACD3,?,00008000), ref: 00FCB126

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: b5d343065fc41862cc8cf6edf13c6808d182eda711cd21e61f31e47bf91e45e0
Instruction ID: aa7e30e182248fd0c7d94fe248332ac6afe95911318db43e3b7adbaad5fed74d
Opcode Fuzzy Hash: b5d343065fc41862cc8cf6edf13c6808d182eda711cd21e61f31e47bf91e45e0
Instruction Fuzzy Hash: 1C112735C0152EE7CF10AFA5EA5ABEEBB78BF09711F10408AD941B2181CB305A50EB92

Function 00FF7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FF7E33
ScreenToClient.USER32(?,?), ref: 00FF7E4B
ScreenToClient.USER32(?,?), ref: 00FF7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FF7E8A

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 036baee10a48db4098ba237a578cac1a01cf76505d395ab8ededb78a68b0a72b
Instruction ID: d3e82d4cd89d2af6ecb7ef561682a06c436bd4a11e80ceef3b4833b38e144142
Opcode Fuzzy Hash: 036baee10a48db4098ba237a578cac1a01cf76505d395ab8ededb78a68b0a72b
Instruction Fuzzy Hash: 191132B9D0420EAFDB41DF98C9849EEBBF9FF08310F505056E915E2210D735AA54DF90

Function 00FC2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00FC2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC2DD6
GetCurrentThreadId.KERNEL32 ref: 00FC2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00FC2DE4

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: a3c775894fbe8d56f1949ce47c99fcd0965997476fe28d71473a07c98cceddc5
Instruction ID: 17e941456000ff581338a10135ff80dd306047191418bc476085dfd0ab337f21
Opcode Fuzzy Hash: a3c775894fbe8d56f1949ce47c99fcd0965997476fe28d71473a07c98cceddc5
Instruction Fuzzy Hash: A5E06D7250523C7AD7201B639E0EFFB3E6CEF52BA1F000019B10AD1080DAA08840E6F0

Function 00FF8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00F79639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F79693
Part of subcall function 00F79639: SelectObject.GDI32(?,00000000), ref: 00F796A2
Part of subcall function 00F79639: BeginPath.GDI32(?), ref: 00F796B9
Part of subcall function 00F79639: SelectObject.GDI32(?,00000000), ref: 00F796E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00FF8887
LineTo.GDI32(?,?,?), ref: 00FF8894
EndPath.GDI32(?), ref: 00FF88A4
StrokePath.GDI32(?), ref: 00FF88B2

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 71db3f67779de70d9e9c6334d3fb7042a417a5591614ae73047f30438710e5bd
Instruction ID: 1027f732a4b7319c64508fdfc87df738bb3d6ead649c1a59efc24b6a7019600f
Opcode Fuzzy Hash: 71db3f67779de70d9e9c6334d3fb7042a417a5591614ae73047f30438710e5bd
Instruction Fuzzy Hash: 46F03A3604526DBADB125F94AD09FEA3E5DAF0A360F048101FB11A50E1CBB95522EBE5

Function 00F798B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00F798CC
SetTextColor.GDI32(?,?), ref: 00F798D6
SetBkMode.GDI32(?,00000001), ref: 00F798E9
GetStockObject.GDI32(00000005), ref: 00F798F1

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 676abcb49cea7fa9cbbbb15c77bbe7c86bd87a1260c581e5e1e712d7d8aa4247
Instruction ID: dd756e481db3eb06149a3af1f1a9faeb7a2dae450315f55b54ad67997dbf4333
Opcode Fuzzy Hash: 676abcb49cea7fa9cbbbb15c77bbe7c86bd87a1260c581e5e1e712d7d8aa4247
Instruction Fuzzy Hash: A5E06531644298AADB215B75AD09BF83F24EF51736F188219F6F9580E1C3714650EF11

Function 00FC162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00FC1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00FC11D9), ref: 00FC163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00FC11D9), ref: 00FC1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00FC11D9), ref: 00FC164F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: ea8a09ba62dd63a2398c354a11d402125fa722ae18576686558de3e6cbdaa7be
Instruction ID: 5e775ef43848308df608bda8b7c895611c155440dc524efd330e5227ea493cc1
Opcode Fuzzy Hash: ea8a09ba62dd63a2398c354a11d402125fa722ae18576686558de3e6cbdaa7be
Instruction Fuzzy Hash: EAE08632A01229DBD7201FB09F0DF663B7CFF457A1F144808F245D9080DA344445F790

Function 00FBD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FBD858
GetDC.USER32(00000000), ref: 00FBD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FBD882
ReleaseDC.USER32(?), ref: 00FBD8A3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: c016a83d4f9be1e5f259ad2dc90141ab2f0a30935d943855dd29d723183e01e2
Instruction ID: b50eaeeffa6edcda335c5ed4c28c38add6a66f2ef25fd3ab96fe1de0e02c6baf
Opcode Fuzzy Hash: c016a83d4f9be1e5f259ad2dc90141ab2f0a30935d943855dd29d723183e01e2
Instruction Fuzzy Hash: 41E0E5B1804218DFCB419FA0DA08A7DBBB9AF08311B108409E84AE7350DB388901FF91

Function 00FBD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FBD86C
GetDC.USER32(00000000), ref: 00FBD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FBD882
ReleaseDC.USER32(?), ref: 00FBD8A3

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 2adaa7ddb49c028ad00e595d98dea2aeb75041156ac2745777134226d06cd042
Instruction ID: 76349e99695ec1e679931abbf44e4c3f4ae2c474ef4ece05faa15dfc912a0049
Opcode Fuzzy Hash: 2adaa7ddb49c028ad00e595d98dea2aeb75041156ac2745777134226d06cd042
Instruction Fuzzy Hash: 1CE012B1804218EFCB40AFA0DA08A7DBBB9BF08310B108409E84AE7350CB385902FF90

Function 00FD4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67620: _wcslen.LIBCMT ref: 00F67625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00FD4ED4

Strings

*, xrefs: 00FD4E10
LPT, xrefs: 00FD4DFB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 5e5d9a0c89ca583527f5d2b4dbe2e1a3f4ed1970301b2e853ac32efcf1d249a4
Instruction ID: 548172e31ebc20c3913b70d1fb1849ac50d08b54d6b5413804002c676e30dd7e
Opcode Fuzzy Hash: 5e5d9a0c89ca583527f5d2b4dbe2e1a3f4ed1970301b2e853ac32efcf1d249a4
Instruction Fuzzy Hash: 40917375E002449FCB14DF54C484EA9BBF6BF44314F18809AE80A9F3A2D735ED85DB91

Function 00F8E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00F8E30D

Strings

pow, xrefs: 00F8E2E5, 00F8E302

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 8696321c95358ca2c44ea399251d338f545a6f9872942fc98d3086dd9ef816b7
Instruction ID: 4c69f795b1e8f527bdfd76fa0cf60947b17a937aa113cb0975afaab24b9c5178
Opcode Fuzzy Hash: 8696321c95358ca2c44ea399251d338f545a6f9872942fc98d3086dd9ef816b7
Instruction Fuzzy Hash: 8A514D71E2C30196EF267714CD053FA3F94AB40760F344969E0D5422DDDB398C95BB46

Function 00F7E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00F7E1B1

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 51dfc106711c8d37842590c2aaeebef48b81f142e3b74eaabf0520e61a873977
Instruction ID: 0861ad70ff76c74265929154bdd49159f7edce2c8a6cce9cc9b551c34faa7305
Opcode Fuzzy Hash: 51dfc106711c8d37842590c2aaeebef48b81f142e3b74eaabf0520e61a873977
Instruction Fuzzy Hash: 42516635E04246EFDB14DF68C4406FA7BA8EF19320F248056ECA19B2D1DA349D42FB91

Function 00F7F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00F7F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00F7F2BB

Strings

@, xrefs: 00F7F2AF

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 8299b7323bcbe1627c6a81ce2ed9ba045c6843d48c214709d42629a4d68eea3a
Instruction ID: 807ddc9e70531d08e9ff0ef23c4161b8c63d59f2df3c755c783a606e73a06c4c
Opcode Fuzzy Hash: 8299b7323bcbe1627c6a81ce2ed9ba045c6843d48c214709d42629a4d68eea3a
Instruction Fuzzy Hash: FB517671418748ABD320AF50DC86BABBBF8FF84304F81884DF2D941195EB758529CBA7

Function 00FE5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00FE57E0
_wcslen.LIBCMT ref: 00FE57EC

Strings

CALLARGARRAY, xrefs: 00FE57E6, 00FE57EB

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 700286f260fd457b84bac928806393ed52ffbad87430b2114ce022dc1c5e2b00
Instruction ID: 04181b5b96cde1c1e4108e43c731ce309e05ef7b741b8efcd72cd4b286238589
Opcode Fuzzy Hash: 700286f260fd457b84bac928806393ed52ffbad87430b2114ce022dc1c5e2b00
Instruction Fuzzy Hash: 0241E231E002099FCB04DFA9C8819BEBBF5FF59728F10402AE505E7251E7349E81EB90

Function 00FDD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FDD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00FDD13A

Strings

|, xrefs: 00FDD10B

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: a87c93ddaca55a12ca1b73bf24ca01ea24ee7400c5e51c7a1f3a8b52e5cb2d34
Instruction ID: 4cd6384006259ca6915d29b7954dac6ab7e5e2657e5c108105cd4f434430d508
Opcode Fuzzy Hash: a87c93ddaca55a12ca1b73bf24ca01ea24ee7400c5e51c7a1f3a8b52e5cb2d34
Instruction Fuzzy Hash: 03314F71D00219ABDF15EFA4CC85EEEBFBAFF14310F140119F815A6262D735AA06EB94

Function 00FF356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00FF3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00FF365C

Strings

static, xrefs: 00FF35BC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 4a0a5e50074bf8ecf2c4c762bb6a10dd4b18b2bb9e4b236162ec45999217c273
Instruction ID: cfd7e2d012cfded45879b7abcfd49e253487fbe93e9c44104c2375b6e699c7b3
Opcode Fuzzy Hash: 4a0a5e50074bf8ecf2c4c762bb6a10dd4b18b2bb9e4b236162ec45999217c273
Instruction Fuzzy Hash: B7319071500208AEDB109F68DC80EFB73A9FF88764F008619FAA5D7290DA75ED81E760

Function 00FF4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00FF461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00FF4634

Strings

', xrefs: 00FF458E

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: a32d005d0bdf711474b9362b83c7e87b6285917f951c23fd67c0f524fbe0817e
Instruction ID: 59a0eff3643c2532d156bf03e448417c0788f0e4a761c363e78acaea3ad3dc06
Opcode Fuzzy Hash: a32d005d0bdf711474b9362b83c7e87b6285917f951c23fd67c0f524fbe0817e
Instruction Fuzzy Hash: 40313975A0020D9FDB14DF69C980BEABBB5FF49310F18406AEA04EB391D770A941DF90

Function 00FF31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00FF327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FF3287

Strings

Combobox, xrefs: 00FF3249

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: e3ea1100e97b2676eca83a944f58090e858bf0c7ff334ce36dfa72030b265490
Instruction ID: bb5d289d26ea4fb27574d29a86f241b318f6cccd943d22601f2b30d4deebcb4a
Opcode Fuzzy Hash: e3ea1100e97b2676eca83a944f58090e858bf0c7ff334ce36dfa72030b265490
Instruction Fuzzy Hash: AD11907160020C7FEF219E54DC80EBB376AEF983A4F104129FA18972A0D6759D51A760

Function 00FF3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00F6600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F6604C
Part of subcall function 00F6600E: GetStockObject.GDI32(00000011), ref: 00F66060
Part of subcall function 00F6600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F6606A

GetWindowRect.USER32(00000000,?), ref: 00FF377A
GetSysColor.USER32(00000012), ref: 00FF3794

Strings

static, xrefs: 00FF3757

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: ba939d703608f1768f141ca477fec52faeb0344706d74d06144afd52cdca7ca3
Instruction ID: 38fb96bc5c389a89aee65a320528cdd1d0059d327606f900cd2f3549e013db14
Opcode Fuzzy Hash: ba939d703608f1768f141ca477fec52faeb0344706d74d06144afd52cdca7ca3
Instruction Fuzzy Hash: CD1129B261020EAFDB00EFA8CC45AFA7BB8EF08354F004914FA55E2260D775E851EB50

Function 00FDCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00FDCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00FDCDA6

Strings

<local>, xrefs: 00FDCD66

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 4d26b47aab2be53f9b7e2044b24ff2240a488a469cfff8d3c47163deec1a5292
Instruction ID: de2815c5dd30a98b0284c13160ef6442554080f7ec91e96ec0050b4f68d980ba
Opcode Fuzzy Hash: 4d26b47aab2be53f9b7e2044b24ff2240a488a469cfff8d3c47163deec1a5292
Instruction Fuzzy Hash: 6A11A3726056377AD7285B668C45FF7BE6FEF127B4F04422BF52983280D6609840E6F0

Function 00FF3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00FF34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00FF34BA

Strings

edit, xrefs: 00FF348F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f844c4a534cff739c1ae2c36dbb436c0bc723fd3416eaea91e0e8a80d1082809
Instruction ID: b2572f7617b8f6e7e627df7cc817b5f436e6a7d50f88fb300d50a144bc0fdab8
Opcode Fuzzy Hash: f844c4a534cff739c1ae2c36dbb436c0bc723fd3416eaea91e0e8a80d1082809
Instruction Fuzzy Hash: DD116A7150021CAAEB228E64DC84ABA3B6AEF05374F504724FA65931E4C775EC51BB60

Function 00FC6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

CharUpperBuffW.USER32(?,?,?), ref: 00FC6CB6
_wcslen.LIBCMT ref: 00FC6CC2

Strings

STOP, xrefs: 00FC6CBC, 00FC6CC1

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 7293866c469a20c920b26b167ba0c0275728a0517de7b6ed70ed9a52c498e288
Instruction ID: c8a0e1105b663aa98438ab5ef84c7e8b454a3164699ab0a11e79f91436c7427c
Opcode Fuzzy Hash: 7293866c469a20c920b26b167ba0c0275728a0517de7b6ed70ed9a52c498e288
Instruction Fuzzy Hash: 4A01C832A085278BCB20DFBDDE82EBF77B5EE61720750052CE452D7194EA35D900E650

Function 00FC1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00FC1D4C

Strings

ComboBox, xrefs: 00FC1CEB
ListBox, xrefs: 00FC1D16

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: bf09ec06a3f45a829dad22a96657d96235ebd298906ad67278f69c1963a1bf1c
Instruction ID: dbcc5b90fecf3157b3ca582d13a2c0f2ed1061ee7d31bcb54194eca6fbd7061f
Opcode Fuzzy Hash: bf09ec06a3f45a829dad22a96657d96235ebd298906ad67278f69c1963a1bf1c
Instruction Fuzzy Hash: CD012D71A0412A6BCB04EBA0CE12EFE73A8FF13360B00090DF863572C2DA755918E660

Function 00FC1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00FC1C46

Strings

ComboBox, xrefs: 00FC1BE5
ListBox, xrefs: 00FC1C10

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 7c0411f91ccbaf6ac257b17186d1b4c6ded06224e6976878a3e6d5a2e275e1c0
Instruction ID: 09ad53c64e696d4c4708189748bdd914d800ba0176fdd5eaae89f0e186c6aabf
Opcode Fuzzy Hash: 7c0411f91ccbaf6ac257b17186d1b4c6ded06224e6976878a3e6d5a2e275e1c0
Instruction Fuzzy Hash: A3018875A8511967CB04EBA0CF52FFF77ACAB12340F14001DB40667182EA649A18F6B1

Function 00FC1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00FC1CC8

Strings

ComboBox, xrefs: 00FC1C69
ListBox, xrefs: 00FC1C94

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 59171bd3d5a636803c4cfc834ddbe735f4cf61ca043d7ef715edf3aa7aaec74b
Instruction ID: 66e3a8bf1ced569d24138a7bffc38b1791635167b920ba1831fc76b437626a0f
Opcode Fuzzy Hash: 59171bd3d5a636803c4cfc834ddbe735f4cf61ca043d7ef715edf3aa7aaec74b
Instruction Fuzzy Hash: 3001A771B4011A67CB04EBA0CF12FFE73ACAB12340F54001DB80177282EA649F28F671

Function 00FC1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00FC1DD3

Strings

ComboBox, xrefs: 00FC1D75
ListBox, xrefs: 00FC1DA0

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 2a088f91ddc93908940f56a59cfbbe8ab291d31f47e2c189e8e9cb68cae9faff
Instruction ID: 55781949973ff1eacb60883add9dd40f4036d01aef2d08401158931f513b3772
Opcode Fuzzy Hash: 2a088f91ddc93908940f56a59cfbbe8ab291d31f47e2c189e8e9cb68cae9faff
Instruction Fuzzy Hash: C8F0F971A4422A67C704F7A4CE53FFF73ACFB02350F04091DF822672C2DA745918A660

Function 00FE747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FE7493
_wcslen.LIBCMT ref: 00FE74B9

Strings

3, 3, 16, 1, xrefs: 00FE7483

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: c96fe72510021ae28c839e2c40c1d109469064e9fb6038dae72b43add5a22633
Instruction ID: 1a17c0040510b12f8e00b1ada52fd58030e65cc20cdc1445c5657810612667b1
Opcode Fuzzy Hash: c96fe72510021ae28c839e2c40c1d109469064e9fb6038dae72b43add5a22633
Instruction Fuzzy Hash: D9E06102705361509331727BDCC19BF7689CFC9770710182BF989C22A6EB98DD91B3A1

Function 00FC0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00FC0B23

Strings

Error allocating memory., xrefs: 00FC0B1C
AutoIt, xrefs: 00FC0B17

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: dc5da8f3c9889cbccae5587723a5d712048335aef35960bc5bfb72509facfde8
Instruction ID: 05311715a1752a9c730f7128112766e2e3306519bb3dc0626a815d1baf784b95
Opcode Fuzzy Hash: dc5da8f3c9889cbccae5587723a5d712048335aef35960bc5bfb72509facfde8
Instruction Fuzzy Hash: 14E0483228532D2AD22437557D03FD97A848F05B61F10442BF798D55D38ED5645076EA

Function 00F80D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F7F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00F80D71,?,?,?,00F6100A), ref: 00F7F7CE

IsDebuggerPresent.KERNEL32(?,?,?,00F6100A), ref: 00F80D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00F6100A), ref: 00F80D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F80D7F

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: fb08084739afbc4d37c1ab260c68633977cfc84ccfbbed7826674d1109a23e9c
Instruction ID: 16385c4b6f840815d8188396ef69e382421e4563fb5a698d67226bfbd56bb1f7
Opcode Fuzzy Hash: fb08084739afbc4d37c1ab260c68633977cfc84ccfbbed7826674d1109a23e9c
Instruction Fuzzy Hash: 8DE06D702003158BD370AFB8D9087927BE8AF04B40F00892DE486C6756DFB5E44CEB91

Function 00FD3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00FD302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00FD3044

Strings

aut, xrefs: 00FD3038

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 42caaef7eed48a3f7f2a324d980c92777042108737d13e351fce946985865064
Instruction ID: 989631d992cf48c0139d431a6ffe8c57365e315e668099a3f81a81e7925b7b04
Opcode Fuzzy Hash: 42caaef7eed48a3f7f2a324d980c92777042108737d13e351fce946985865064
Instruction Fuzzy Hash: AAD05E7250033CA7DA20A7A5AD4EFDB3A6CDB04650F0002A1BA95D6092DAB09984CAD0

Function 00FBD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FBD220

Strings

%.3d, xrefs: 00FBD22B
X64, xrefs: 00FBD2A8

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 00f4b7cf9dd2b166bf0cb693802ea56712bfaede55a24737bbf1908fedaa74c8
Instruction ID: be9e4c01737edf7aac837181272f9b6847830d3e8991afef6995a467ce74b985
Opcode Fuzzy Hash: 00f4b7cf9dd2b166bf0cb693802ea56712bfaede55a24737bbf1908fedaa74c8
Instruction Fuzzy Hash: 84D01262C05159E9CB5096D1CC45AF9B37CEF58301F50C466F90AD1000F628C508BF63

Function 00FF2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FF236C
PostMessageW.USER32(00000000), ref: 00FF2373

Part of subcall function 00FCE97B: Sleep.KERNELBASE ref: 00FCE9F3

Strings

Shell_TrayWnd, xrefs: 00FF2365

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 4ccd1a639ec943d639e00071e2b3c56c5047345766b96723828f5fc7b40eae87
Instruction ID: afe079eb624afd445d3bd23386bc30590b593c0aacffdd7c09fcbcb948f07c49
Opcode Fuzzy Hash: 4ccd1a639ec943d639e00071e2b3c56c5047345766b96723828f5fc7b40eae87
Instruction Fuzzy Hash: D6D022323C03287BE264B730EE0FFC67618AF00B00F00091AB745EA1D0C8F0B800DA84

Function 00FF2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FF232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00FF233F

Part of subcall function 00FCE97B: Sleep.KERNELBASE ref: 00FCE9F3

Strings

Shell_TrayWnd, xrefs: 00FF2325

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: c97aff0c1466ecbf608d6408158dc64b8e4046e766adcb00eec97f6451695f03
Instruction ID: 8d446fb4d4b62dde30dbabd611cb6445ed1be3c980b09e64cd80b3a95571efe3
Opcode Fuzzy Hash: c97aff0c1466ecbf608d6408158dc64b8e4046e766adcb00eec97f6451695f03
Instruction Fuzzy Hash: 70D01276394328B7E664B771EE0FFD67A18AF00B10F04491AB749EA1D0D9F4A811DA94

Function 00F9BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00F9BE93
GetLastError.KERNEL32 ref: 00F9BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F9BEFC

Memory Dump Source

Source File: 00000000.00000002.2902770397.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2902746246.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000000FFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902853534.0000000001022000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902925529.000000000102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2902954342.0000000001034000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 53d7ef8ac76a174c996235f8a69a7c9dbd622d2ac2f64c99aea9cbf4f35345bf
Instruction ID: 11172a842e82981b3ae0e88faf28f1e44148f7a63378c5b92997aa4771848461
Opcode Fuzzy Hash: 53d7ef8ac76a174c996235f8a69a7c9dbd622d2ac2f64c99aea9cbf4f35345bf
Instruction Fuzzy Hash: FE411C35A0420AEFEF219FA4EE44BBA7BA9EF41334F144159F959971A1DB718C00FB60

Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725712038&P2=404&P3=2&P4=j0Y8wo9%2b1wsfZw2uSta2qy3iKMYYIZwVKbmDurNRC%2f70S2VTf7sLxYzpIV4ybj5pFKDLp1R3R%2f0YEO8I%2bsYjjg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: Ejgl2VTz9fs7Cz4ddkR69KSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.4
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.4
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.4
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\14a8b454-674c-4feb-a253-dfdbaad30ed1.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\169626ad-7c64-428e-8792-b53465606e40.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1dc2b5b4-d167-4c11-a6d0-51e6becd1cca.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2114ba7f-f349-4cf0-83d2-c2f01fadac9f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\37461391-635f-4d92-aca0-bffdfcf49bee.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3a8b4752-ace6-4898-9c3a-fb732c993faa.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6e6e003c-3695-436c-b89b-f80e4935f29d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7332da02-21a0-415e-bf3d-8bb68dc0804a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\53a3515f-ed50-4b7a-83d7-c501d85cc5d7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D30C0F-1D5C.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D30C0F-1E50.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0c2be940-2d42-4863-9b44-0e258f174e91.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7a4b2fc4-a152-4e52-b628-050c07dc76e7.tmp

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre